AWS explains why Bedrock AgentCore chose Cedar to secure agentic workflows
AWS published a security blog on May 20 walking through the design rationale behind Bedrock AgentCore's authorization layer: it uses Cedar, the open-source policy language AWS originally built for Verified Permissions. The post argues that the standard 'add guardrails inside the system prompt' pattern fundamentally doesn't work for agents that take real actions, because LLMs are non-deterministic, vulnerable to prompt injection, and can confidently hallucinate harmful tool calls that look legitimate.
Cedar's pitch is declarative, auditable, externally-evaluated policy. Instead of trusting the model to 'remember' that it can't drop a production table, AgentCore evaluates each tool call against a Cedar policy at runtime — outside the model — and either permits or denies it based on principal, action, resource, and context. The policies are human-readable, analyzable (Cedar has a verification mode that proves properties about a policy set), and version-controllable. Crucially they don't depend on the model's compliance.
This is the second AgentCore-themed AWS publication this week, alongside the AWS Heroes three-part series on building a personalized AWS Briefing Agent on AgentCore Runtime using RSS + S3 Vectors + Knowledge Base and the Strands Agents SDK. Together they signal AWS is pushing AgentCore as the opinionated stack for production agents, the same way Bedrock became the opinionated stack for foundation-model inference.
Competitively, Anthropic's Claude managed-agent MCP tunnels and self-hosted sandboxes (shipped May 19) tackle the same problem from the runtime-isolation angle: contain what the agent can reach. AWS is tackling it from the policy angle: contain what the agent is allowed to do. Both approaches will likely converge — sandbox + declarative policy — but AWS's Cedar bet is the first major cloud taking a public, opinionated stance on what 'agent authorization' should look like. Skeptics in HN-style threads will ask whether Cedar's expressiveness is enough for the messier real-world cases.
