Control agent behaviors and cost beyond a single action: new capabilities in Amazon Bedrock AgentCore

Amazon Bedrock AgentCore now includes new controls that reach past a single tool call. The AWS Machine Learning Blog describes temporal policies powered by Dogwood, an open source policy language for AI agents, plus rate limiting on the gateway. Together these features are meant to give deterministic control over sequences of agent actions and cost ceilings that hold regardless of how the agent behaves.

Temporal policies sit on multi-step agent runs rather than one-off decisions. Dogwood expresses rules about which actions may follow which others, and over what window, so operators can constrain chains of tool use instead of only approving or denying each call in isolation. Gateway rate limiting caps how often agents can hit tools or backends through that path, so throughput and spend do not scale unbounded when the agent retries, loops, or expands its plan.

For engineers shipping production agents, single-action guardrails leave gaps when a model chains tools, re-plans, or retries under ambiguous goals. Sequence-level policy and hard rate limits turn those gaps into enforceable constraints at the platform edge. Builders can encode allowed action order and cost ceilings in policy and gateway config instead of relying only on prompt instructions or post-hoc audit of free-running tool use.

That places AgentCore in the governance layer of the agent stack, where control is shifting from “did this call look safe?” to “does this run stay inside a declared sequence and budget?” Competing stacks already compete on models, tool wiring, and orchestration; deterministic temporal policy and gateway cost ceilings compete on operational control. Dogwood being open source also matters for teams that want portable policy definitions rather than logic locked inside one vendor’s closed policy format.

Practical next step is to map your highest-risk multi-step flows—payment, data export, admin APIs, long tool chains—to temporal rules in Dogwood and set gateway rate limits that match real cost and abuse ceilings. Watch how Dogwood policies compose with existing AgentCore auth and tool allowlists, and whether rate limits are applied per agent, per tenant, or per tool. Use those answers to decide which production agents can leave soft prompt limits and move under hard sequence and cost control.