Securing AI Agents with Temporal Policies in Amazon Bedrock AgentCore

Amazon Bedrock AgentCore now offers temporal policies that extend its existing stateless policy engine to evaluate each request in the context of prior events in an agent's session. Because they run at the AgentCore Gateway perimeter, outside the agent's code, they cannot be intercepted or manipulated. Use cases include enforcing output integrity across chained tools, tool-call ordering, human approval for privileged actions, and data freshness. The policies operate on Model Context Protocol (MCP) tool calls, agent-to-agent calls, and model inference calls routed through the gateway. Each request must carry an x-amzn-bedrock-agentcore-policy-session-id header, and sessions are defined by combining the session ID with the end user's identity, with a maximum look-back window of 24 hours. The blog post walks through an example of a private banking agent, requiring policies such as enforcing the order of tool calls (get_client_profile, then load_portfolio, then rebalance_portfolio), ensuring portfolio_id matches, requiring market prices within 1 minute of trade, capping total trade value at $60,000 per session, requiring approval for trades over $25,000, preventing buying and selling the same security at a loss, and disabling write operations after 15 minutes of inactivity. The implementation uses the Dogwood policy language, which supports Cedar policies and enables temporal conditions.