AI Agent - Aug 9, 2026

AgentCore GovCloud Policy: Cedar and Gateway Guide

Q: What is the difference between LOG_ONLY and ENFORCE?

LOG_ONLY evaluates and logs decisions but allows every tool call to continue. ENFORCE applies allow or deny decisions. Use representative allow and deny tests before changing to ENFORCE.

Quick answer

Policy in AgentCore creates an authorization boundary around tool traffic that passes through an associated AgentCore Gateway. Teams can write Cedar directly or describe an English rule that AgentCore turns into candidate Cedar. Review the generated policy, test it against the real tool schema in LOG_ONLY, and protect the permission that can change the Gateway to ENFORCE, back to LOG_ONLY, or remove the engine.

For AWS GovCloud (US-West), verify the target account and current deployment path. AWS announced base Policy availability on August 7, 2026, but the GovCloud differences page says Bedrock Guardrails Policy and Temporal Policy are unavailable and lists Policy and PolicyEngine CloudFormation resources as unavailable.

What the policy boundary covers

An AgentCore policy engine stores deterministic policies and associates with a Gateway. The Gateway evaluates requests before allowing tool access. Policies can use identity and tool-input attributes to state who may perform which action on which resource under which conditions.

This is stronger than asking a model to follow a prompt, because the decision is evaluated outside agent code. It is still a scoped boundary:

it does not cover a tool call made outside the associated Gateway;
it does not authenticate the incoming identity by itself;
it does not replace downstream service authorization;
it does not validate that a permitted action is factually correct or operationally safe;
it does not make every external endpoint or data path GovCloud-compliant.

Draw the full path from caller authentication through agent identity, Gateway authorization, Policy evaluation, outbound credentials, and downstream resource enforcement.

Natural language is an authoring input, not final authority

AWS documents a workflow in which an English prompt generates candidate Cedar, validates the policy against the tool schema, and checks conditions such as overly permissive, overly restrictive, or unsatisfiable rules.

That workflow can speed authoring, but the enforceable artifact is the reviewed policy, not the prose prompt. Preserve:

the business rule and named owner;
the exact tool schema and version;
generated Cedar and validation output;
positive, negative, boundary, and malformed-input tests;
reviewer approval and rollback conditions;
the deployed policy version and Gateway association.

Avoid broad wildcards unless the business rule requires and explicitly approves them. Check resource identifiers, tenant claims, amounts, destinations, tool names, and action parameters independently.

Roll out from LOG_ONLY to ENFORCE

AgentCore supports two enforcement modes:

LOG_ONLY: evaluates and logs whether a tool call would be allowed or denied, but every call proceeds.
ENFORCE: applies the allow or deny result to the operation.

Use LOG_ONLY only as an observation step; it is not a protective control. Replay representative traffic, compare expected decisions, investigate missing attributes, test explicit denies, and define an acceptable false-allow and false-deny threshold before enforcement.

AWS also warns that a principal with bedrock-agentcore:UpdateGateway can switch from ENFORCE to LOG_ONLY or remove the policy engine. Restrict that permission to trusted deployment principals, monitor changes, and test the alert and rollback path.

GovCloud implementation differences

The current GovCloud AgentCore page lists:

no Bedrock Guardrails Policy;
no Temporal Policy;
no AWS::BedrockAgentCore::Policy CloudFormation resource;
no AWS::BedrockAgentCore::PolicyEngine CloudFormation resource;
no Gateway semantic search.

Do not copy a commercial-Region architecture that depends on those controls. If the supported API, SDK, CLI, or infrastructure-as-code path does not meet the organization’s change-control requirements, keep the workload out of production until an approved deployment and drift-control path exists.

Test matrix

Case	Expected result	Separate evidence
Correct user, allowed tool, bounded input	Allow	Downstream resource also authorizes action
Correct user, wrong tenant or resource	Deny	Tenant identifier cannot be caller-forged
Missing or malformed identity claim	Deny	Gateway authentication fails safely
Allowed tool, prohibited amount or destination	Deny	Input field reaches policy in expected type
Tool call outside governed Gateway	Block elsewhere	Network and service policy prevent bypass
Change from ENFORCE to LOG_ONLY	Alert and approved rollback	UpdateGateway is narrowly granted and audited
Policy engine unavailable	Fail according to documented design	Application and downstream controls remain safe

Policy logs are evidence of evaluated requests, not proof that every business transaction was correct. Reconcile important actions with downstream audit records and human approvals.

A safer starter policy request

Using the versioned Gateway tool schema, propose Cedar that permits only named principals to call the named tool for resources in their authorized tenant and within the approved input bounds. Show every identity and input attribute used, produce allow and deny tests, identify bypass paths and missing attributes, and keep the Gateway in LOG_ONLY until the generated Cedar and observed decisions are reviewed. Do not create or update resources.

Frequently asked questions

Where does Policy in AgentCore enforce a decision?

A policy engine associated with an AgentCore Gateway evaluates agent traffic through that Gateway before tool access. Calls that bypass the governed Gateway need their own authorization controls.

Can teams write AgentCore policies in natural language?

AWS supports English natural-language authoring that generates candidate Cedar policies and validates them against tool schemas. Security owners should review the resulting Cedar and tests before enforcement.

What is the difference between LOG_ONLY and ENFORCE?

LOG_ONLY evaluates and logs decisions but allows every tool call to continue. ENFORCE applies allow or deny decisions. Use representative allow and deny tests before changing to ENFORCE.

Does GovCloud support every AgentCore policy feature?

No. AWS currently lists Bedrock Guardrails Policy and Temporal Policy as unavailable in GovCloud and lists AgentCore Policy and PolicyEngine CloudFormation resource types as unavailable. Verify current APIs and deployment tooling in the target account.

Continue by decision

Start with the AgentCore GovCloud launch and architecture guide.
Separate recall design with short-term versus long-term memory.
Run the AgentCore GovCloud readiness check before enforcement.
For policies that require prior-action state, read the Temporal versus stateless Policy guide and note that AWS currently lists Temporal Policy as unavailable in GovCloud.

Official sources

Source check: August 9, 2026. Verify Region support, policy types, authoring and validation behavior, Gateway modes, IAM actions, CloudFormation coverage, logs, quotas, and prices before enforcement.