An agent decides for itself which tools to call, which is powerful and a little scary: it might misread a rule, or be tricked into doing something it should not. Policy puts an automatic checkpoint in front of every tool call, outside the agent, that allows or blocks it based on rules you set, so the agent literally cannot cross the lines you draw.
New to these words? Read chapter 02 "Key terms" (tool, MCP). See also chapter 11 "Gateway".Policy is a checkpoint that sits at the Gateway and inspects every tool call before it runs. You write rules (in plain English or in Cedar, AWS's open-source rules language), store them in a policy engine, and attach the engine to a gateway. From then on, every request is checked against the rules and allowed or denied, the same way every time.
The agent tries to call a tool, say "process a $2000 refund".
The request hits the gateway, where the policy engine sits.
The engine checks the tool, who is asking, and the inputs against your rules.
Permitted calls go through; the rest are blocked. Default is deny; any "forbid" wins.
The decision is recorded in CloudWatch for audit.
Because the check is at the boundary, outside the agent, it is deterministic: the same input always gives the same decision, and a clever prompt cannot talk it out of a rule. In ENFORCE mode, everything is denied unless a rule permits it, any forbid wins, and every decision is logged.