View a markdown version of this page

Schema constraints - Amazon Bedrock AgentCore
Principal TypesResource TypeActionsContextWhat You Cannot Do

Schema constraints

Policies for Amazon Bedrock AgentCore Gateway must validate against a specific Cedar schema that is automatically generated from the Gateway’s MCP tool manifest. This schema defines what’s possible in your policies.

Principal Types

The principal type depends on the authentication method configured for your AgentCore Gateway:

AgentCore::OAuthUser

  • Used for OAuth-authenticated gateways

  • Has an id attribute (from JWT sub claim)

  • Supports tags for OAuth claims (username, scope, role, etc.)

AgentCore::IamEntity

  • Used for IAM-authenticated gateways (AWS_IAM authorizer)

  • Has an id attribute containing the caller’s IAM ARN

  • Does not support tags; use pattern matching on principal.id for access control

Resource Type

  • Must be AgentCore::Gateway

  • Represents the MCP Gateway instance

  • Can be matched by type ( is ) or specific ARN ( == )

  • Must use specific ARNs to refer to specific actions

Actions

  • Each MCP tool becomes an action: AgentCore::Action::"ToolName"

  • All tool actions inherit from CallTool → Mcp hierarchy

  • Example: Action::"RefundTool___process_refund" is a CallTool

Context

  • Only available context is context.input

  • Contains the tool’s input parameters as defined in the MCP manifest

  • Each tool has a typed input structure (e.g., RefundTool___process_refundInput)

  • Parameter types are automatically mapped from the action schema to Cedar types.

The following table shows the correspondence between the 7 basic JSON Schema types and Cedar types:

JSON Schema Cedar Notes

string

String

integer

Long

boolean

Bool

number

Decimal

Decimal is an extension type in Cedar, which does not exactly match IEEE floating point numbers, so numbers will be truncated to the Cedar representation

object

Record

The type correspondence is applied recursively to properties, and the list of required properties is used to decide which properties of the record are required

array

Set

Cedar Set does not have a notion of item order, so the order of items in the JSON array does not get translated to Cedar

null

Entity

Because Cedar does not have a 1:1 match for a type that is solely null, schemas will contain a unique entity to represent each null-type

Treat this table as a high-level overview. For more information about detailed and nuanced use cases, see the open-source MCP schema generator on GitHub.

What You Cannot Do

  • Cannot reference entity types outside AgentCore namespace

  • Cannot access context fields other than context.input (context.output can only be used with guardrails)

  • Cannot use custom attributes on OAuthUser (use tags instead)

  • Cannot define new entity types in policies