AWS Bedrock AgentCore adds temporal policies to stop AI agents from going rogue
New session-aware policies at the gateway prevent agents from hallucinating tool calls mid-trajectory.
AWS has added temporal policies to Amazon Bedrock AgentCore, its managed agent runtime, to solve a critical security gap: stateless access controls treat each tool call as independent, but AI agents decide tools, arguments, and ordering at runtime—making a single call safe in isolation but dangerous in context. Temporal policies evaluate each gateway-routed request against the agent's full trajectory (the ordered sequence of prior events in the session) and run at the AgentCore Gateway perimeter, outside the agent's own code. That makes them tamper-proof: the agent cannot intercept or modify the policy, regardless of prompt injection attacks or bugs in the agent logic.
Practical use cases include enforcing output integrity across chained tools (e.g., requiring a transfer_funds argument to exactly match a prior lookup_customer output, preventing hallucinated account numbers), enforcing SOP tool-call ordering, requiring human approval for privileged actions, and capping cumulative financial exposure per session. Policies also enforce data freshness, blocking decisions based on stale lookups. Since AgentCore Gateway already routes Model Context Protocol (MCP) tool calls, agent-to-agent calls, and model inference calls through one point, temporal policies add a stateful enforcement layer without requiring changes to agent code—making them adoptable for existing deployments.
- Temporal policies run at the AgentCore Gateway perimeter, outside agent code, so agents cannot bypass them via prompt injection or code flaws.
- They enforce trajectory-aware rules like matching tool-call arguments to prior outputs, blocking hallucinated data between chained tools.
- Typical use cases include capping cumulative financial exposure per session, requiring human approval for high-value actions, and validating data freshness before dependent tool calls.
Why It Matters
Enterprises deploying AI agents get session-aware security controls that close the gap where individual API calls pass but combined actions cause real harm.