PRODUCTION SCENARIO
A travel company's refund agent calls a refund tool through Amazon Bedrock AgentCore Gateway. The security team requires that refunds above $500 be allowed only for supervisor identities. The rule must be enforced outside the agent's own code so that a manipulated prompt cannot bypass it.
Which solution will meet these requirements?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Policy in AgentCore
Policy in AgentCore intercepts all agent traffic through Gateway and evaluates each request against defined policies before tool access is allowed, with fine-grained permissions based on user identity and tool input parameters. Because enforcement sits outside the agent's code, a manipulated prompt cannot bypass it, whereas a system prompt instruction can be overridden.