AWS has expanded Amazon Bedrock AgentCore with two new gateway capabilities designed to enforce governance over sequences of agent actions rather than just individual requests: temporal policies powered by Dogwood, and native rate limiting. Both features are available now without requiring changes to existing agent code.
The core problem AgentCore targets is the gap between what looks safe in isolation and what becomes risky in aggregate. An agent might pass individual approval thresholds on every call while still executing a harmful pattern across a session. A transfer to the wrong account can look legitimate step by step; a series of purchases can stay under individual limits while exceeding a budget; a retry loop can burn tokens indefinitely because no one caps total consumption. According to McKinsey research cited in the AWS announcement, roughly 80% of organizations have already encountered risky behavior from AI agents, and security and risk concerns are now the leading barrier to scaling agentic AI in production.
Temporal policies change the evaluation window. Instead of judging each request stateless, the gateway inspects the sequence of actions an agent has already taken in the current session. That lets teams enforce ordering constraints, require matching values across steps, tally cumulative spend against a budget, or mandate recorded human approval for significant actions. Permissions can also narrow automatically when a person disengages. The policy engine runs outside the agent’s code at the gateway layer, so the agent cannot reason around or override it through prompting.
Dogwood is the open source policy language that powers temporal policies. Built on Cedar and released under the Apache 2.0 license, it adds temporal constructs including rate limits, time windows, prerequisite steps, and escalation triggers specifically for agent governance. The Dogwood reference implementation is available on GitHub, giving teams full visibility into how policies evaluate and allowing the broader ecosystem to build supporting tooling.
Rate limiting complements behavioral controls by capping consumption. Teams can now set ceilings on requests per user, tokens processed per model, and connection duration across every tool, model, and agent behind the gateway. Limits apply in per-second and per-minute windows and take effect immediately without agent-code changes. Different users, teams, tools, and models can carry different ceilings, letting platform teams shift capacity allocation from custom code to configuration. Forrester identified cost as the leading reason agentic AI struggles to reach scale, and these ceilings directly address runaway consumption from retry loops or reasoning-heavy sessions.
For practitioners deploying agents through AgentCore, the immediate takeaway is that governance moves from per-request checks to session-level boundaries. That distinction matters most for teams running long-lived, semi-autonomous workflows where cumulative behavior matters more than any single step.
If you are already routing production agents through Amazon Bedrock AgentCore via n8n, temporal policies and rate limits can now be applied at the gateway without refactoring your existing agent logic.
