AMAZON BEDROCK / SERVICE DETAIL S10 POLICY
AGENTCORE POLICYPRACTICAL
CHAPTER 24 / 36
TOPIC block a refund over $1000, at the gateway
REV 2026.07
IN PLAIN WORDS
You will put a checkpoint in front of a refund tool so the agent can only refund under $1000. You add a gateway, a Lambda tool, and a policy engine in ENFORCE mode, then write the rule in Cedar or plain English. Terms: policy engine = the box that holds and checks rules; ENFORCE = actually block, not just observe; Cedar = AWS's rules language; permit/forbid = allow/deny.
[ 1 ] BUILD THE GUARDED TOOL
$ npm install -g @aws/agentcore
$ agentcore create --name PolicyDemo --defaults && cd PolicyDemo
$ agentcore add gateway --name PolicyGateway --authorizer-type NONE --runtimes PolicyDemo
$ agentcore add gateway-target --name RefundTarget --type lambda-function-arn \
--lambda-arn <YOUR_LAMBDA_ARN> --tool-schema-file refund_tools.json --gateway PolicyGateway
$ agentcore add policy-engine --name RefundPolicyEngine \
--attach-to-gateways PolicyGateway --attach-mode ENFORCE # ENFORCE = actually block
[ 2 ] WRITE THE RULE, TWO WAYS
PLAIN ENGLISH generated into Cedar
$ agentcore add policy --name RefundLimit \
--engine RefundPolicyEngine \
--generate "Only allow refunds under 1000 dollars" \
--gateway PolicyGateway
# --generate needs the gateway deployed first (it resolves the ARN for you)
CEDAR refund_policy.cedar
permit(principal,
action == AgentCore::Action::"RefundTarget___process_refund",
resource == AgentCore::Gateway::"<gateway-arn>")
when {
context.input.amount < 1000
};
$ agentcore add policy --name RefundLimit --engine RefundPolicyEngine --source refund_policy.cedar
[ 3 ] DEPLOY AND TEST
$ agentcore deploy && agentcore status # status shows the gateway URL
# $500 is under the limit -> ALLOWED
$ curl -X POST <GATEWAY_URL> -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"RefundTarget___process_refund","arguments":{"amount":500}}}'
# $2000 is over the limit -> DENIED by the policy engine
ENFORCE mode: every call is checked, default is deny unless a rule permits, and any forbid wins. Decisions are logged to CloudWatch. Cleanup: agentcore remove gateway --name PolicyGateway, then agentcore remove policy-engine --name RefundPolicyEngine, then agentcore deploy.