Area and publish date filters for Internet Search on AgentCore

When an AI agent makes use of Internet Search to floor its solutions on behalf of a buyer, the group behind that agent wants area and date filters to manage which sources the agent consults and the way contemporary these sources should be. A financial-services agent shouldn’t floor its solutions in an unvetted weblog. A product-information agent shouldn’t cite pricing or stock information from three years in the past when the person requested about present availability, as inventory ranges and pricing change quickly.

At present, we’re asserting runtime area and published-date filtering for Internet Search on Amazon Bedrock AgentCore, a platform to construct, join, and optimize brokers at scale with any framework or mannequin. This functionality ships as a part of the web-search connector model 1.2.0. These capabilities give builders per-call management over which net domains their brokers can search and what publication-date window outcomes should fall inside, all enforced server-side. No exterior orchestration is required. When mixed with current admin-level area insurance policies, organizations have a layered filtering mannequin that enforces enterprise governance whereas giving particular person API calls the pliability to slender scope dynamically, per request.

Alongside runtime filtering, this launch additionally expands Internet Search availability to 2 new AWS Areas: eu-west-1 (Dublin) and ap-northeast-1 (Tokyo). Prospects in Europe and Asia Pacific can now invoke Internet Search from a regional endpoint nearer to their workloads, decreasing latency and offering an EU-based entry level for organizations with information proximity necessities. AgentCore makes use of a zero-egress structure the place search queries stay inside AWS. This regional growth provides regulated prospects in these areas a path to grounded brokers with out routing visitors throughout the Atlantic.

On this submit, we stroll by means of what runtime filtering is, why it issues, how the layered admin-plus-runtime mannequin works, easy methods to get began with the brand new API parameters, and what regional availability means to your workloads.

What’s new in connector model 1.2.0

This launch introduces two new capabilities inside the filters object of the Internet Search device enter schema:

1. Runtime area filtering

Cross an embrace (allowlist) or exclude (denylist) listing of domains on each instruments/name invocation. This offers per-request management over which sources the agent could seek the advice of.

Every listing helps as much as 100 domains, counted independently.

2. Printed-date filtering

Prohibit outcomes to content material printed inside a selected date vary utilizing ISO-8601 UTC bounds:

Each filters are optionally available and utilized per request. Omitting them preserves the prevailing habits the place all listed content material is eligible.

Why runtime filtering issues

Actual-world agent workloads demand extra granular management than organization-wide insurance policies alone can present:

1. Per-task supply restriction: A compliance agent analyzing regulatory updates ought to solely search .gov domains and accepted publishers, not the open net.
2. Temporal scoping: A market-intelligence agent summarizing “this week’s earnings calls” ought to by no means floor outcomes from prior quarters, even when they rank extremely for the question.
3. Dynamic enable/deny at name time: A multi-tenant platform serving totally different prospects might have totally different area insurance policies per request, with out creating separate targets for every tenant.
4. Content material freshness ensures: A buyer help agent answering “what modified within the newest launch” ought to solely return documentation printed prior to now 7 days.

Runtime filtering addresses these wants by transferring management into the API name itself.

The way it works: The request stream

The next diagram exhibits the lifecycle of a filtered search request: your agent sends a instruments/name with question and filters, the Gateway merges your runtime filters with the admin-level coverage, executes the filtered question towards the net index, enforces compliance on the uncooked outcomes, and returns solely verified outcomes to your agent to floor its response on.

Your entire lifecycle is server-side. There’s no client-side filtering loop, no post-processing, and no further roundtrips.

The layered filtering mannequin: Admin + runtime

A key design precept of this launch is that runtime filters can slender however by no means broaden the scope set by an administrator. This ensures enterprise coverage is at all times enforced, no matter what a runtime caller requests. The admin-level area lists are arrange throughout creation of the connector useful resource.

Merge logic

The next diagram illustrates how admin-level and runtime filter lists mix: embrace lists merge by intersection (solely domains current in each lists survive) whereas exclude lists merge by union (a site blocked at both degree stays blocked). Discover how d.com is dropped from the efficient allowlist as a result of it seems solely within the runtime listing, not the admin coverage.

Determine 2: How admin and runtime area lists merge, intersecting embrace lists and unioning exclude lists

Area embrace (allowlist): The efficient allowlist is the intersection of admin and runtime lists. If the admin permits [a.com, b.com, c.com] and the runtime name consists of [b.com, c.com, d.com], solely b.com and c.com are searched. The area d.com is outdoors the admin area listing and is silently dropped.

Area exclude (denylist): The efficient denylist is the union of admin and runtime lists. If the admin blocks [x.com] and the runtime name excludes [y.com], each are blocked.

Observe: A runtime caller can’t search a site the admin hasn’t allowed and might’t unblock a site the admin has denied. Runtime filters can solely additional limit the search area.

Filter compliance habits

When filters are energetic, Internet Search prioritizes precision over recall. Outcomes that may’t be verified towards your filter standards are excluded quite than returned unfiltered:

1. Area filter energetic: Outcomes with no recognizable area are excluded from consideration.
2. Date filter energetic: Outcomes with no acknowledged publication date are excluded.

You may obtain fewer outcomes when filters are energetic, however each outcome you do obtain satisfies your specified filter standards.

Cap enforcement

There are 4 lists: admin embrace, admin exclude, runtime embrace, and runtime exclude. Every helps as much as 100 entries independently. For full configuration particulars and composition guidelines, see Configure area filtering within the Developer Information.

Getting began

Internet Search is delivered by means of AgentCore Gateway, a functionality of Amazon Bedrock AgentCore that gives a managed endpoint, appropriate with the Mannequin Context Protocol (MCP), for connecting brokers to instruments. Comply with these steps to allow runtime area and date filtering to your Internet Search goal.

Stipulations

1. An Amazon Bedrock AgentCore Gateway with a Internet Search goal pinned to connector model 1.2.0 or later.
2. AWS Id and Entry Administration (IAM) permissions: your calling agent or software wants bedrock-agentcore:InvokeGateway on the gateway Amazon Useful resource Identify (ARN), and the Gateway’s service function wants bedrock-agentcore:InvokeWebSearch. See Configure the Gateway Service Position for the whole coverage.
3. The most recent AWS SDK (Python, JavaScript, Java, .NET, Go, Ruby, or PHP).

Step 1: Create a Internet Search goal with model 1.2.0

Use AWS SDK for Python (Boto3) to create (or replace) a goal pinned to model 1.2.0, with admin-level area insurance policies. If you have already got a Internet Search goal on model 1.1.0, you need to use UpdateGatewayTarget to pin it to model 1.2.0 as an alternative of making a brand new goal. For added setup choices, together with the AgentCore CLI and console, see Arrange Internet Search Device.

import boto3

gateway_client = boto3.shopper("bedrock-agentcore-control", region_name="us-east-1")

# Create a Internet Search goal pinned to model 1.2.0 with admin-level area filtering
goal = gateway_client.create_gateway_target(
    gatewayIdentifier="your-gateway-id",
    identify="web-search-filtered",
    targetConfiguration={
        "mcp": {
            "connector": {
                "supply": {"connectorId": "web-search", "model": "1.2.0"},
                "configurations": [
                    {
                        "name": "WebSearch",
                        "parameterValues": {
                            "domainFilter": {
                                "include": [
                                    "approved-wire-1.com",
                                    "approved-wire-2.com",
                                    "sec.gov",
                                    "investor.gov",
                                ],
                                "exclude": ["unreliable-source.net"],
                            }
                        },
                    }
                ],
            }
        }
    },
    credentialProviderConfigurations=[
        {"credentialProviderType": "GATEWAY_IAM_ROLE"}
    ],
)

print(f"Goal ID: {goal['targetId']}")
print(f"Standing: {goal['status']}")

Step 2: Invoke with runtime filters

Think about your agent displays SEC enforcement actions for a authorized crew. The crew solely trusts sec.gov as a main supply, and so they want actions from the present month, not historic filings. Right here’s the instruments/name payload your agent sends:

{
    "jsonrpc": "2.0",
    "id": "1",
    "technique": "instruments/name",
    "params": {
        "identify": "WebSearch",
        "arguments": {
            "question": "newest SEC enforcement actions 2026",
            "filters": {
                "domainFilter": {
                    "embrace": ["sec.gov"],
                    "exclude": []
                },
                "publishedDateFilter": {
                    "from": "2026-07-01T00:00:00Z",
                    "to": "2026-08-04T23:59:59Z"
                }
            }
        }
    }
}

The agent receives solely outcomes from sec.gov printed within the final 5 weeks. There’s no third-party authorized commentary or outdated filings within the outcomes.

Observe: The device identify in your instruments/name request is the identify found by means of instruments/listing, which follows the sample <target-name>___WebSearch. For the goal created earlier, that’s web-search-filtered___WebSearch. The runtime embrace listing (sec.gov) intersects with the admin listing (approved-wire-1.com, approved-wire-2.com, sec.gov, investor.gov). As a result of sec.gov seems in each, it’s searched. In case you handed some-other-site.com, it might be silently dropped as a result of it’s not within the admin allowlist.

Pattern code examples

Listed here are some examples of how you need to use the MCP shopper created from the AgentCore Gateway with the brand new filters at runtime. Code pattern to create MCP shopper for calling instruments

Instance 1: Medical analysis assistant with regulatory quotation necessities

You’re constructing a analysis assistant for a pharmaceutical firm’s regulatory affairs crew. Firm coverage mandates that each reply cite solely FDA, NIH, or ClinicalTrials.gov. A quotation from a well being weblog isn’t solely a top quality subject. It’s a compliance violation that might floor in an audit. The agent must implement this on each search, no matter what question the mannequin constructs.

import json

# Pharma analysis assistant: solely accepted regulatory sources
compliance_request = json.dumps({
    "jsonrpc": "2.0",
    "id": "req-001",
    "technique": "instruments/name",
    "params": {
        "identify": "WebSearch",
        "arguments": {
            "question": "FDA drug approval course of 2026 steering",
            "maxResults": 10,
            "filters": {
                "domainFilter": {
                    "embrace": ["fda.gov", "nih.gov", "clinicaltrials.gov"]
                }
            }
        }
    }
})

# Ship by way of your MCP shopper (SigV4-signed or OAuth-authenticated)
response = mcp_client.ship(compliance_request)
outcomes = json.hundreds(response)

# Each result's from fda.gov, nih.gov, or clinicaltrials.gov
for end in outcomes["result"]["content"]:
    print(outcome["text"])

Each outcome your agent cites is now verifiably from an accepted regulatory supply. Even when a WebMD article ranks #1 for the question, it by no means enters the mannequin’s context window.

Instance 2: Inventory-update agent, solely this week’s protection

Your buying and selling desk runs an agent that generates inventory updates all through the buying and selling day. The issue: when a dealer asks “what’s the most recent on semiconductor shares?”, the agent used to floor a highly-ranked evaluation from final quarter, and a dealer who acts on stale protection loses cash. You want each outcome to be from the previous 7 days, no exceptions.

from datetime import datetime, timedelta, timezone

# Calculate the 7-day window
now = datetime.now(timezone.utc)
seven_days_ago = now - timedelta(days=7)

stock_update_request = json.dumps({
    "jsonrpc": "2.0",
    "id": "req-002",
    "technique": "instruments/name",
    "params": {
        "identify": "WebSearch",
        "arguments": {
            "question": "semiconductor shares newest developments",
            "maxResults": 15,
            "filters": {
                "publishedDateFilter": {
                    "from": seven_days_ago.strftime("%Y-%m-%dTpercentH:%M:%SZ"),
                    "to": now.strftime("%Y-%m-%dTpercentH:%M:%SZ")
                }
            }
        }
    }
})

response = mcp_client.ship(stock_update_request)

The agent’s inventory updates now draw solely on protection printed within the final seven days. That highly-ranked evaluation from final quarter? It by no means reaches the mannequin, so it may by no means mislead a dealer.

Observe: Outcomes with no acknowledged publication date are excluded when the date filter is energetic. This ensures each returned result’s verifiably inside your time window.

Instance 3: Investor-relations compliance, main sources, present quarter solely

Your investor-relations crew makes use of an agent to arrange earnings evaluation drafts. Two exhausting guidelines: (1) solely main sources: SEC filings and official investor pages: by no means crowdsourced monetary commentary websites, and (2) solely publications from this quarter, as a result of citing final quarter’s numbers in a current-quarter evaluation is a fabric error. You want each constraints enforced concurrently on each search.

# IR compliance agent: main sources + present quarter solely
financial_request = json.dumps({
    "jsonrpc": "2.0",
    "id": "req-003",
    "technique": "instruments/name",
    "params": {
        "identify": "WebSearch",
        "arguments": {
            "question": "AMZN quarterly earnings report Q2 2026",
            "maxResults": 10,
            "filters": {
                "domainFilter": {
                    "embrace": ["sec.gov", "investor.gov"],
                    "exclude": ["example-crowd-commentary-1.com", "example-crowd-commentary-2.com"]
                },
                "publishedDateFilter": {
                    "from": "2026-04-01T00:00:00Z",
                    "to": "2026-08-04T23:59:59Z"
                }
            }
        }
    }
})

response = mcp_client.ship(financial_request)

The agent’s draft now cites solely official filings and wire experiences from Q2 and Q3 2026. Crowdsourced commentary and opinion items are blocked even when they match the question completely. Something from prior quarters is excluded no matter supply.

Instance 4: SaaS platform with per-tenant supply insurance policies

You use a research-agent SaaS platform serving healthcare, authorized, and financial-services prospects. Every tenant has contractually agreed supply insurance policies. Your healthcare buyer’s Enterprise Affiliate Settlement (BAA) requires citations from PubMed, CDC, and accepted medical analysis databases solely. Your authorized buyer insists on Cornell LII and official courtroom data. Your finance buyer mandates SEC, the Federal Reserve, and accepted wire providers. You’ll be able to’t spin up a separate gateway goal per tenant (you will have 200 tenants and counting), so that you apply tenant-specific filters at runtime utilizing the Strands Brokers SDK.

from strands import Agent
from strands.fashions import BedrockModel
from strands.instruments.mcp.mcp_client import MCPClient
from mcp.shopper.streamable_http import streamablehttp_client

# Per-tenant area insurance policies (out of your config database)
TENANT_POLICIES = {
    "tenant-healthcare": {
        "embrace": ["pubmed.ncbi.nlm.nih.gov", "who.int", "cdc.gov"],
        "exclude": ["example-consumer-health-site.com"],
    },
    "tenant-legal": {
        "embrace": ["law.cornell.edu", "supremecourt.gov", "uscourts.gov"],
        "exclude": [],
    },
    "tenant-finance": {
        "embrace": ["sec.gov", "federalreserve.gov", "example-approved-wire.com"],
        "exclude": ["example-social-forum-site.com"],
    },
}


def search_for_tenant(tenant_id: str, question: str, days_back: int = 30):
    """Execute a policy-compliant net seek for a selected tenant."""
    from datetime import datetime, timedelta, timezone

    coverage = TENANT_POLICIES[tenant_id]
    now = datetime.now(timezone.utc)
    date_from = (now - timedelta(days=days_back)).strftime("%Y-%m-%dTpercentH:%M:%SZ")

    def create_transport():
        return streamablehttp_client(
            gateway_url,
            headers={"Authorization": f"Bearer {get_token()}"},
        )

    mcp_client = MCPClient(create_transport)

    mannequin = BedrockModel(
        model_id="us.anthropic.claude-sonnet-4-20250514-v1:0",
        max_tokens=2048,
    )

    with mcp_client:
        instruments = mcp_client.list_tools_sync()
        agent = Agent(mannequin=mannequin, instruments=instruments)

        # The agent's system immediate instructs it to go these filters
        # on each WebSearch invocation
        system_prompt = f"""You're a analysis assistant. When utilizing WebSearch,
ALWAYS embrace these filters in your device name:

- domainFilter.embrace: {coverage['include']}
- domainFilter.exclude: {coverage['exclude']}
- publishedDateFilter.from: {date_from}

By no means search outdoors accepted domains."""

        outcome = agent(question, system_prompt=system_prompt)
        return outcome.message


# Utilization
reply = search_for_tenant(
    "tenant-healthcare",
    "What are the most recent scientific trial outcomes for GLP-1 medication?"
)

One gateway goal serves 200 tenants, every with their very own supply coverage, enforced dynamically at name time. Your healthcare tenant’s agent won’t ever cite Reddit or WebMD, and your finance tenant’s agent won’t ever cite a weblog submit, despite the fact that they share the identical underlying infrastructure.

Necessary: System-prompt-based filtering (as proven earlier) depends on the agent following directions. It isn’t exhausting enforcement. For exhausting enforcement, configure allowed domains on the goal degree (admin embrace listing). Runtime filters handed straight within the instruments/name payload present API-level enforcement that can not be bypassed by the mannequin.

Enter schema reference

The filters object launched in connector model 1.2.0 provides domainFilter (embrace/exclude lists, as much as 100 domains every) and publishedDateFilter (inclusive ISO-8601 UTC bounds) alongside the prevailing question and maxResults fields. For the whole enter schema and field-by-field reference, see Enter schema within the Amazon Bedrock AgentCore Developer Information.

Availability and 0 information egress

Runtime area and date filtering is on the market as we speak within the US East (N. Virginia) (us-east-1), Europe (Eire) (eu-west-1), and Asia Pacific (Tokyo) (ap-northeast-1) Areas for Internet Search on Amazon Bedrock AgentCore.

Internet Search advantages from the zero information egress structure of AgentCore: search queries are served fully inside AWS infrastructure. Buyer queries will not be despatched to a third-party search engine or routed outdoors AWS. For organizations in regulated industries, similar to monetary providers, healthcare, and authorities, this removes a whole class of compliance assessment.

Backward compatibility

These options are totally backward appropriate:

1. No breaking modifications. Model 1.2.0 is a minor launch. The brand new fields are additive and the filters object is optionally available. Present API calls with out filters proceed to work precisely as earlier than.
2. SDK help. Accessible throughout AWS SDKs (Python (Boto3), JavaScript/TypeScript, Java, .NET, Go, Ruby, and PHP SDKs), AWS Command Line Interface (AWS CLI) and AgentCore CLI.
3. Console help. The AWS Console for AgentCore Internet Search targets now surfaces each embrace and exclude domain-list inputs within the connector configuration UI.

Conclusion

Runtime area and published-date filtering give builders constructing on Amazon Bedrock AgentCore Gateway the per-call precision they should construct reliable, policy-compliant brokers with out sacrificing the simplicity of a managed, server-side search device.

Whether or not you’re limiting an agent to accepted regulatory sources, scoping outcomes to the final 24 hours, or dynamically making use of tenant-specific insurance policies, Internet Search on AgentCore retains you in management with zero information egress, IAM-native authentication, and no exterior dependencies.

These options can be found as we speak in US East (N. Virginia) (us-east-1), Europe (Eire) (eu-west-1), and Asia Pacific (Tokyo) (ap-northeast-1) AWS Areas for Internet Search on Amazon Bedrock AgentCore.

Get began as we speak:

In regards to the authors