이미지: AWS ML Blog
Summary
- Amazon has added a temporal policy feature to Bedrock AgentCore that validates action sequences at the session level
- The feature is powered by a new open-source policy language called Dogwood, and rate limiting has also been introduced at the gateway
- According to a McKinsey survey, about 80% of organizations have reportedly experienced risky behavior from AI agents
- 발표 주체
- AWS ML Blog, 작성자 마두 파르타사라티
- 신규 기능
- 템포럴 정책(도그우드 기반), 게이트웨이 속도 제한
- 도그우드
- AI 에이전트 전용 신규 오픈소스 정책 언어
- 게이트웨이 역할
- MCP 서버·LLM·에이전트·지식베이스로 트래픽을 라우팅하는 완전관리형 서버리스 진입점
- 맥킨지 통계
- 조직의 약 80%가 AI 에이전트의 위험 행동을 경험(State of AI Trust in 2026)
- 발행일
- 2026-08-06
Agent trust is becoming the biggest barrier to scaling
Amazon Web Services (AWS) announced new security and cost control features for Amazon Bedrock AgentCore. Citing a McKinsey survey, AWS said "about 80% of organizations have already experienced risky behavior from AI agents," noting that security and risk concerns have become the biggest barrier to scaling agentic AI.
The limits of guardrails that only look at individual actions
AWS pointed out that most existing guardrails were designed with predictable software in mind. Because agents determine their own path as they operate, each individual step can pass review on its own even as the overall flow goes unchecked. AWS cited three examples: an agent that looks up an account and then transfers funds to another account, an agent that splits a single purchase into multiple orders each under the approval threshold but exceeding the total limit, and an agent that retries a failed tool call overnight, burning through its token budget. Each individual request was legitimate on its own — the pattern itself was the problem, AWS explained.
Temporal policies built on Dogwood
The newly added temporal policy feature extends the existing policy engine. Previous policies were stateless, evaluating each request quickly and independently, but temporal policies now also examine the actions an agent has already taken within a given session before deciding whether to allow the next call. This makes it possible to require that a value returned from a previous call match the value fed into a later call, or to tally cumulative spending within a session and block the next purchase once a budget is exceeded — even if each individual purchase falls under its own limit. It can also enforce that steps proceed in a required order, or require a record of human approval for critical actions. This capability is powered by a newly released open-source policy language called Dogwood.
Gateway rate limiting also introduced
Bedrock AgentCore's gateway is a fully managed, serverless entry point through which all AI traffic passes on its way to MCP servers, LLMs, agents, and knowledge bases. AWS explained that because every call passes through this single point, it chose to place limits that apply regardless of how an agent behaves at the gateway level. The newly added rate limiting feature implements this principle in terms of traffic frequency, serving to maintain a cost ceiling in situations like token-draining retry loops.
Feature comparison
| Category | Scope | Core behavior |
|---|---|---|
| Existing policies | Individual actions | Evaluates each request independently |
| Temporal policies (Dogwood) | Entire session sequence | Verifies cumulative spending, order, and consistency of prior call values |
| Gateway rate limiting | All gateway traffic | Limits request frequency to maintain a cost ceiling |
METAL LAB's previous coverage of agent-related news has repeatedly highlighted the control issues that come with increasingly autonomous AI agents.
Remaining challenges
AWS said that once trusted guardrails are in place, approving new agents could shift from a case-by-case negotiation to a platform-level process. However, the announcement did not include specifics on Dogwood's syntax, the precise scope of temporal policy application, or concrete figures for rate limiting, so the real-world impact of the rollout remains to be seen.
