Amazon Bedrock AgentCore adds policy controls for AI agents

The most striking addition to Amazon Bedrock AgentCore is Dogwood, a bespoke open source language designed to define AI agent behavior over time. Where most agent controls focus on single, isolated actions, Dogwood lets developers script entire sequences, transitions, and dependencies. This moves AI agents closer to repeatable, deterministic workflows—vital for any business trying to keep automation predictable and auditable.

Dogwood doesn’t just restrict what an agent can do in the moment; it sets guardrails for how those actions unfold across multiple steps. For example, you can require an agent to verify user authentication before accessing sensitive data, or limit how often it can trigger a costly database operation. These policies form a backbone for responsible automation, especially in regulated sectors.

Temporal policies set rules not just for individual API calls, but for sequences and timing. Think of it as a choreography for agents—if an operation must happen only after completing another, or only within a certain window, that’s now programmable. This gives businesses confidence that AI automations won’t run wild or rack up unintended expenses through runaway loops.

For use cases like contract approvals or customer onboarding, where multi-step processes must unfold in a strict order, temporal policies make compliance and audit trails possible. In the projects we run, this level of control separates enterprise-grade AI from experiments.

Another practical addition: granular rate limiting and spending caps on the agent’s gateway. Unlike basic throttling, these controls operate at the agent workflow level. Companies can set global ceilings on how many actions or requests an agent executes in a given period, and strict spending limits. No more waking up to a surprise bill because an agent got stuck in a loop or was triggered too often by overzealous users.

For SaaS vendors and internal IT teams alike, such cost controls are now table stakes. They protect margins, and—crucially—help convince finance and compliance teams that automation won’t become a blank check.

AI agents aren’t static scripts; they’re increasingly complex systems that make independent decisions. Without guardrails, even well-intentioned automations can drift into shadow IT territory or violate process requirements. Policy-driven controls like those in AgentCore bring AI agents into the fold of enterprise governance. You can now define, document, and enforce the boundaries of agent behavior, aligning automation with regulatory and ethical standards.

For sectors like healthcare, finance, or public services, this isn’t a nice-to-have—it’s the difference between innovation and exposure. Temporal policies and cost ceilings help CIOs sleep at night, knowing AI isn’t quietly undermining compliance or budgets.

Amazon’s decision to release Dogwood as open source signals a pragmatic shift: policy languages for AI will need ecosystem-wide buy-in and extensibility. As more businesses assemble multi-vendor AI stacks, closed policy engines become bottlenecks. By inviting the community to contribute and audit, Amazon is hedging against this fragmentation—and likely aiming for Dogwood to become a standard.

For technical leaders, this means fewer vendor lock-in headaches. Policies can be portable, reviewable, and adaptable as business needs evolve. It’s a quiet but meaningful step toward maturing how we supervise and scale AI agents.