AWS Adds Temporal Policies and Rate Limiting to Amazon Bedrock AgentCore to Govern AI Agent Behavior at Scale

Amazon Web Services (AWS) has added two new governance capabilities to Amazon Bedrock AgentCore: temporal policies for evaluating sequences of agent actions, and rate limiting at the gateway layer to control token and request consumption. Both features are available today.

The update addresses a gap in existing agent guardrails, which evaluate each action in isolation. AWS says that model, while fast and provable, misses risks that only become visible across a sequence of actions — for example, an agent that looks up an account and then transfers funds to a different account, or one that places multiple orders each under an approval threshold but collectively over budget.

Temporal policies, powered by Dogwood

Temporal policies extend AgentCore's existing deterministic policy engine, which checks each tool call against rules about who can call what and under what conditions. The new layer adds session-level state: the policy engine now evaluates a call against what the agent has already done in that session before permitting or denying it.

According to AWS, this allows teams to:

• Block a transfer if a value passed into one call doesn't match what an earlier call returned
• Tally spending across a session and block a purchase once a budget is reached, even if that purchase is under the individual per-call limit
• Require actions to happen in a specific order
• Require recorded human approval before a significant action executes
• Automatically narrow permissions when a human is no longer engaged in the session

These checks run at the gateway layer, outside the agent's own code, so AWS says the agent cannot reason around the policy regardless of prompting. Decisions are deterministic and deny-by-default, and each blocked call is logged with the context behind the decision.

The capability is powered by Dogwood, a new open source policy language built on Cedar, AWS's existing policy language. Dogwood embeds Cedar and adds temporal constructs — rate limits, time windows, prerequisite steps, and escalation triggers — designed specifically for evaluating agent action sequences as they unfold. AWS is releasing Dogwood as an open specification and reference implementation under the Apache 2.0 license, giving customers visibility into how policies are evaluated and allowing third parties to build supporting tooling.

Rate limiting on the gateway

AgentCore's gateway is a managed, serverless entry point that routes agent traffic to Model Context Protocol (MCP) servers, LLMs, agents, and knowledge bases. AWS has added rate limiting there, letting teams cap consumption per user — identified through existing OAuth or IAM identities — across every tool, model, and agent behind the gateway.

Limits can be set on three dimensions: number of requests, number of tokens processed, and duration of open connections. AWS says all three are needed because agents consume resources differently: a retry loop shows up as request volume, a reasoning-heavy task shows up as token consumption, and a long research session shows up as an open connection with little traffic. Limits apply in per-second and per-minute windows and take effect without any changes to agent code. Different users, teams, tools, and models can carry different ceilings.

Pricing for AgentCore gateway usage was not disclosed in the announcement; the new policy and rate-limiting features do not carry a separate stated price.

AWS cites McKinsey's State of AI Trust research finding that roughly 80% of organizations have encountered risky behavior from AI agents, and separate McKinsey and Forrester research identifying security and cost as leading barriers to scaling agentic AI deployments.

What this means

This release targets the operational gap between demoing an agent and running one in production with real financial or access consequences. Stateless, per-call authorization has been the default because it is simple and fast to verify; extending it to session-level, sequence-aware evaluation is a meaningfully harder engineering problem, and AWS's approach — pushing the logic into the gateway rather than into agent code — mirrors how network security and API rate limiting evolved for conventional software.

The more consequential move may be open-sourcing Dogwood. Cedar itself is already open source and used outside AWS; if Dogwood's temporal extensions gain adoption as a shared specification, it could become a de facto standard for agent governance the way OAuth became a standard for authorization — reducing the odds that every cloud vendor ships an incompatible, proprietary policy language. Whether that happens depends on adoption by Anthropic, OpenAI, Microsoft, and other agent-platform vendors, none of whom have adopted Dogwood as of this announcement.