AI Agents Need Time Rules for Tool Calls

On 6 August, AWS introduced Temporal Policies for Amazon Bedrock AgentCore. These rules assess not only an individual tool call, but its prior history within an agent session. For production AI agents, that matters more than another prompting trick: an action may be permitted in isolation and still be risky in context.

From a single permission to a history

Traditional access control answers questions such as: may this identity call this tool? With agents, that is not always sufficient. A portfolio agent may retrieve market data and execute an order. Execution, however, should only be possible after checking the client profile, portfolio, current price and, where required, an approval.

AWS enforces the new rules at the AgentCore Gateway, outside the agent code. They take earlier events in a session into account. AWS gives examples including mandatory sequencing, protection against fabricated data between tool calls, cumulative financial limits and human approval for high-value actions. According to AWS, the rules are restrictive by default; where policies conflict, a prohibition wins.

Why this is an operating-model issue

This addresses a central point in OWASP’s analysis of “Excessive Agency”: harm does not only arise from a weak model, but also from overly broad functionality, permissions or autonomy. OWASP therefore recommends minimum tool functions and permissions, authorization in downstream systems, and human approval for consequential actions.

Temporal Policies do not replace those measures. They add auditable state logic. Instead of “the agent may pay,” a better rule becomes: “the agent may trigger this payment only for this identity, after the specified checks, up to a session limit, and with approval above the threshold.”

What DACH organisations should check now

Do not begin with a general agent policy. Start with one specific business process. For every critical tool, define prerequisites, permitted sequence, session limit, approval threshold, technical enforcement point and audit trail. Keep the session short and unambiguous as well: AWS notes that only one authorization request per session can be processed at a time and that the look-back window is limited to 24 hours.

The key architecture question is therefore not only which tool an agent may use. It is: Which history must the system prove before that call is permitted?