# Most agent security still stops at the tool call.

A permission check runs once, the action executes, and nobody asks what happened three steps earlier.

That gap is where excessive agency lives.

An agent that is allowed to read a file is not the same as an agent that should be allowed to read a file, delete a record, and then email a customer, all in one uninterrupted sequence.

AWS just moved the fence.

Bedrock AgentCore's new policy language, called Dogwood, enforces control across a whole action sequence instead of a single tool call.

Temporal policies track state across the run, so an agent cannot fabricate data partway through and have a later step trust it.

Gateway rate limits cap traffic per user and per target, not just per request.

Put together, this is sequence-level authorization: • What ran before this step • What state that step left behind • What this step is now allowed to do because of it

Single-action permission checks were built for APIs, not for agents that plan their own path through a task.

An agent is not one call.

It is a chain, and the chain is what needs the policy, not the link.

#ai #agents #security