Temporal Policies: Trajectory-Aware Agent Authorization

Agents are becoming more autonomous and teams are running more of them, but trust and security have not kept pace: McKinsey estimates roughly 80% of organizations have already encountered risky behavior from AI agents, making security the leading barrier to scaling agentic AI. Traditional authorization is stateless — each tool call is judged alone and allowed if it passes. The problem is that individual calls can each pass while a trajectory, taken together, oversteps. In August 2026, AWS introduced temporal policies on the Bedrock AgentCore gateway: evaluate the agent's action sequence at the gateway, rather than judging each request in isolation.

The Blind Spot of Stateless Authorization

Historically, policy engines made stateless judgments: does this request meet the conditions, quickly and provably — exactly what authorization has always required. But as agents take on longer tasks with less supervision, a new question arises: whether its actions, taken together, add up to something that should be allowed. That is only visible when you look at the sequence of actions, not individual ones.

Consider the classic examples: a transfer to the wrong account can be blocked by a policy requiring that a value passed into one call match what an earlier call returned; a session can tally spending and block the next purchase once the budget is reached, even if that purchase is under the individual limit; steps can be required to happen in a set order; a significant action can require a recorded human approval; and permissions can narrow automatically when a person is no longer engaged.

Enforced at the Gateway, Invisible to the Agent

Temporal policies are enforced at the AgentCore Gateway perimeter, outside the agent's own code. The agent does not see the policy logic and cannot reason around it, regardless of how it is prompted or whatever defects it carries. For security leaders being asked to approve autonomous systems, this is the distinction that matters: trusting an agent to behave versus knowing the boundary holds over the course of its actions.

Because the gateway routes an agent's MCP tool calls, agent-to-agent calls and model inference calls through a single endpoint, one temporal policy can govern all three. Decisions are deterministic, deny by default, forbid wins over permit, and are logged with full context — a reviewer can see not only that a call was blocked but why.

Dogwood: An Open-Source Policy Language for Agents

Powering temporal policies is Dogwood, a new policy language purpose-built for AI agents. Built on AWS's Cedar, it adds the temporal constructs needed to evaluate whether an agent's action sequence conforms to policy: rate limits, time windows, prerequisite steps, escalation triggers. Dogwood is available as an open-source specification and reference implementation under Apache 2.0, giving customers full visibility into how policies are evaluated and letting the ecosystem build supporting tooling. Because Dogwood is compatible with existing Cedar policies, customers can continue using them without migrating.

Seven Reusable Trajectory-Aware Patterns

In a private-banking portfolio agent example, the paper demonstrates seven reusable temporal policy patterns: data freshness (a market price must have been retrieved within the last 30 seconds before a trade executes); workflow sequencing (pull the client profile, then load the portfolio, before any rebalance); output-to-input integrity (the portfolio_id passed to execute_trade must exactly match one returned by get_client_profile); cumulative budget caps (total trade value per session capped at $60,000, containing blast radius from runaway agents or successful attacks); human approval for large actions (trades over $25,000 require explicit advisor approval, one approval consumed per trade); mutual exclusion (no buy-then-sell at a loss within the same trajectory); and progressive trust decay (after 15 minutes without advisor interaction, the agent loses write access, restorable at any time).

The OOMeta View

Temporal policies mark agent authorization moving from stateless to stateful: the boundary begins to understand trajectories of behavior. The most valuable lesson for enterprises is not a specific cloud feature but the underlying judgment — security boundaries belong outside the agent's reasoning loop, enforced uniformly by the infrastructure layer, and capable of understanding what a sequence of actions means together. The more autonomous and capable an agent becomes, the more an enterprise can confidently grant autonomy only if the system it runs inside holds its boundaries under unexpected behavior.

References: AWS, "Control agent behaviors and cost beyond a single action: new capabilities in Amazon Bedrock AgentCore", 2026-08-06, https://aws.amazon.com/blogs/machine-learning/control-agent-behaviors-and-cost-beyond-a-single-action-new-capabilities-in-amazon-bedrock-agentcore/ · AWS, "Securing AI agents with temporal policies in Amazon Bedrock AgentCore", 2026-08-06, https://aws.amazon.com/blogs/machine-learning/securing-ai-agents-with-temporal-policies-in-amazon-bedrock-agentcore/