Schema constraints - Amazon Bedrock AgentCore
Principal TypeResource TypeActionsContextWhat You Cannot Do

Schema constraints

Policies for Amazon Bedrock AgentCore Gateway must validate against a specific Cedar schema that is automatically generated from the Gateway's MCP tool manifest. This schema defines what's possible in your policies.

Principal Type

  • Must be AgentCore::OAuthUser

  • Represents OAuth-authenticated users

  • Has an id attribute (from JWT sub claim)

  • Supports tags for OAuth claims (username, scope, role, etc.)

Resource Type

  • Must be AgentCore::Gateway

  • Represents the MCP Gateway instance

  • Can be matched by type (is) or specific ARN (==)

  • Must use specific ARNs to refer to specific actions

Actions

  • Each MCP tool becomes an action: AgentCore::Action::"ToolName"

  • All tool actions inherit from CallTool → Mcp hierarchy

  • Example: Action::"RefundTool__process_refund" is a CallTool

Context

  • Only available context is context.input

  • Contains the tool's input parameters as defined in the MCP manifest

  • Each tool has a typed input structure (e.g., RefundTool___process_refundInput)

  • Parameter types are automatically mapped from JSON Schema to Cedar types:

    • string → String

    • integer → Long

    • boolean → Bool

    • number → Decimal

What You Cannot Do

  • Cannot reference entity types outside AgentCore namespace

  • Cannot access context fields other than context.input

  • Cannot use custom attributes on OAuthUser (use tags instead)

  • Cannot define new entity types in policies