Quick answer
Use AgentCore temporal policies for tool order when action B should be authorized only after action A completed in the same policy session. Add field correlation when B must use the exact identifier or value returned by A. Add a short time window when A’s data must still be fresh.
These are three separate controls:
- sequence: the prerequisite response exists;
- integrity: the current input matches trusted prior output;
- freshness: that response occurred recently enough.
Combining all three prevents an agent from skipping the lookup, substituting another identifier, or acting on an old result. It does not prove the source system returned correct data.
Model the dependency before writing policy
For each dependent action, complete this table:
| Field | Example question |
|---|---|
| Current action | Which sensitive tool is being authorized? |
| Required predecessor | Which completed action must exist first? |
| Matching resource | Must both events refer to the same Gateway resource? |
| Correlated fields | Which output values must equal current inputs? |
| Freshness window | How long is the predecessor valid? |
| Failure result | Deny, retry the read, or require human review? |
Do not use a generic “lookup happened” condition if the later action can target a different customer, account, document, or asset.
Sequence and response semantics
AWS records a permitted action that completes as a response event. A denied predecessor is recorded as an error event. If a temporal condition searches for a prior response, a denied or incomplete call cannot satisfy it.
Wait for the predecessor response before issuing the dependent request. Sending both concurrently can cause the policy to evaluate the second request before the required response exists in the session history.
For multi-step chains, test every missing or reordered step:
- final action with empty history;
- first step only;
- second step without the first;
- correct steps in the wrong order;
- correct sequence on a different resource;
- correct sequence and matching data;
- a retry after partial failure.
Output-to-input integrity
Bind the current request to the smallest trusted field from the earlier response. For example, a transfer request might need the exact account ID returned by a customer lookup. A prompt-injected or hallucinated ID then fails authorization even if the agent is otherwise allowed to call both tools.
The schema is part of the security contract. Version field names and types, reject missing values, and test arrays or nested records explicitly. Policy cannot correlate data that was never recorded in a usable event field.
Freshness windows
Choose the window from the business risk:
- rapidly changing prices may justify seconds;
- inventory or availability may tolerate minutes;
- a reviewed configuration might remain valid longer;
- a high-risk action may require a new read every time.
AWS currently permits up to 24 hours per temporal condition, but the maximum is not a recommendation. A recent response only establishes timing. Continue to validate the source, timestamp meaning, data quality, and downstream preconditions.
Rollout and observability
Start in LOG_ONLY with versioned traces that include expected allows and denials. Promote to ENFORCE only after verifying:
- correct event kind and field mapping;
- session ID and identity propagation;
- predecessor completion order;
- exact boundary behavior at the freshness cutoff;
- retry and idempotency handling;
- latency and error monitoring;
- safe response when a request is denied.
AWS exposes temporal latency and evaluation span signals through AgentCore observability. Those signals show evaluation activity; they do not by themselves prove that the business rule was correct.
Frequently asked questions
Can AgentCore require one tool before another?
Yes. A temporal condition can require a matching prior response event within the same policy session before permitting the dependent action.
Can a policy verify that a later input matches an earlier output?
Yes. Dogwood temporal conditions can correlate fields from a recorded event with fields in the current request, subject to the declared schema.
Does data freshness mean the data is correct?
No. A freshness policy proves that a matching read completed inside the configured time window. Source quality, completeness, and business validity still need separate checks.
When is a prior response available to a temporal policy?
After the permitted predecessor action completes and its response event is recorded. Issue the dependent request only after receiving that response.
Related guides
- Full AgentCore temporal policies guide
- Session ID and 24-hour window
- Approval and cumulative cap patterns
- Temporal policy planner
Official sources
Source check: August 8, 2026. Verify current syntax, event schemas, quotas, Regions, and enforcement behavior before deploying a policy.