# AddPolicyOptions

Options for adding a policy via PolicyEngine.addPolicy().

- Source: [`aws-bedrockagentcore/lib/policy/policy-types.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/policy/policy-types.ts#L48)
- Type last changed: v2.269.0 · 10 Sep 2026

## Example

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.anyOf([
      'AgentCore::Action::WeatherTool__get_forecast',
      'AgentCore::Action::WeatherTool__get_current',
    ]),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
  }),
  description: "Allow specific weather tool operations",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action in [
//     AgentCore::Action::"WeatherTool__get_forecast",
//     AgentCore::Action::"WeatherTool__get_current"
//   ],
//   resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123"
// );
```

## Properties

- `description`: string — Optional description for the policy (max 4,096 characters).

  **Default:** No description

- `policyName`: string — The name of the policy.

  **Default:** Auto-generated unique name

  Valid characters: a-z, A-Z, 0-9, _ (underscore)
  Must start with a letter, 1-48 characters

- `statement`: [PolicyStatement](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyStatement.html) (required) — The Cedar policy statement for this policy.

  Build a type-safe statement with the `PolicyStatement` factories, or use
  `PolicyStatement.fromCedar('...')` for raw Cedar. Raw Cedar is treated as trusted
  input: the module does not escape, quote, or validate it.

- `validationMode`: [PolicyValidationMode](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyValidationMode.html) — Validation mode for the policy.

  **Default:** PolicyValidationMode.FAIL_ON_ANY_FINDINGS