# PolicyEngineMode

The enforcement mode for a policy engine associated with a gateway.

- Source: [`aws-bedrockagentcore/lib/gateway/gateway.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/gateway/gateway.ts#L231)
- Type last changed: v2.269.0 · 10 Sep 2026

## Example

```ts

// Create a Policy engine
const policyEngine = new agentcore.PolicyEngine(this, "MyPolicyEngine", {
  policyEngineName: "my_policy_engine",
  description: "Policy engine for access control",
});

const gateway = new agentcore.Gateway(this, "MyGateway", {
  gatewayName: "my-gateway",
  policyEngineConfiguration: {
    policyEngine: policyEngine,
    mode: agentcore.PolicyEngineMode.ENFORCE, // This is the default
  },
});

// Add policy to policy engine
policyEngine.addPolicy("AllowAllActions", {
  statement: agentcore.PolicyStatement.fromCedar(`
    permit(
      principal,
      action,
      resource == AgentCore::Gateway::"${gateway.gatewayArn}"
    );
  `),
  description: "Allow all actions on specific gateway (development)",
  validationMode: agentcore.PolicyValidationMode.IGNORE_ALL_FINDINGS, // This will ignore all cedar warnings
});

// you can add multiple policies to the policy engine
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: agentcore.PolicyStatement.fromCedar(`
    permit(
      principal is AgentCore::OAuthUser,
      action == AgentCore::Action::"WeatherTool__get_forecast",
      resource == AgentCore::Gateway::"${gateway.gatewayArn}"
    );
  `),
  description: "Allow specific weather tool access",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS, // This will fail policy creation for any cedar warning
});
```

## Properties

- `ENFORCE`: [PolicyEngineMode](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyEngineMode.html) (static) — Enforces decisions by allowing or denying agent operations based on Cedar policies.

- `LOG_ONLY`: [PolicyEngineMode](/cdk/api/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyEngineMode.html) (static) — Evaluates actions and adds traces but does not enforce decisions.

  Use this mode for testing and validation before enabling enforcement.

- `value`: string — The string value of the policy engine mode.

## Methods

- `of(value: string): PolicyEngineMode // chainable` (static) — A policy engine mode that this version of the CDK does not model.

  Prefer the static members above. Use this when the service has added a mode
  that the CDK has no member for yet: the CloudFormation registry schemas that
  validate the synthesized template ship with `aws-cdk-lib` and refresh on
  release, while the members above are added by hand, so a released CDK can
  accept a mode before it models one.

  **Parameters**

  - `value` — the raw mode value to pass to CloudFormation.