Most agent security still stops at the tool call.
A permission check runs once, the action executes, and nobody asks what happened three steps earlier.
That gap is where excessive agency lives.
An agent that is allowed to read a file is not the same as an agent that should be allowed to read a file, delete a record, and then email a customer, all in one uninterrupted sequence.
AWS just moved the fence.
Bedrock AgentCore's new policy language, called Dogwood, enforces control across a whole action sequence instead of a single tool call.
Temporal policies track state across the run, so an agent cannot fabricate data partway through and have a later step trust it.
Gateway rate limits cap traffic per user and per target, not just per request.
Put together, this is sequence-level authorization: • What ran before this step • What state that step left behind • What this step is now allowed to do because of it
Single-action permission checks were built for APIs, not for agents that plan their own path through a task.
An agent is not one call.
It is a chain, and the chain is what needs the policy, not the link.
#ai #agents #security