Domain and publish date filters for Web Search on AgentCore
Amazon Bedrock AgentCore introduces runtime domain and published-date filtering for Web Search via connector version 1.2.0, enabling per-call control over source domains and content freshness Filters are enforced server-side with no external orchestration required, supporting include (allowlist) and exclude (denylist) domain lists of up to 100 domains each The layered filtering model merges admin-level policies with runtime filters: include lists intersect and exclude lists union, ensuring runti
Analysis
TL;DR
- Amazon Bedrock AgentCore introduces runtime domain and published-date filtering for Web Search via connector version 1.2.0, enabling per-call control over source domains and content freshness
- Filters are enforced server-side with no external orchestration required, supporting include (allowlist) and exclude (denylist) domain lists of up to 100 domains each
- The layered filtering model merges admin-level policies with runtime filters: include lists intersect and exclude lists union, ensuring runtime calls can only narrow—not expand—admin scope
- Web Search expands to eu-west-1 (Dublin) and ap-northeast-1 (Tokyo), leveraging AgentCore's zero-egress architecture for reduced latency and data proximity compliance
- Key use cases include compliance agents restricted to .gov domains, market-intelligence agents needing temporal scoping, multi-tenant platforms requiring per-request domain policies, and support agents needing content freshness guarantees
Why It Matters
This release addresses a critical gap in enterprise AI agent deployment: the need for granular, per-request control over web search grounding without sacrificing enterprise governance. By combining admin-level policies with runtime filters, AWS enables organizations to maintain strict security boundaries while allowing dynamic, context-aware search behavior—essential for regulated industries like finance and healthcare where source credibility and data freshness directly impact compliance and trust.
Technical Details
- Runtime domain filtering: Two new fields in the filters object—
filters.domainFilter.include(allowlist) andfilters.domainFilter.exclude(denylist)—applied pertools/callinvocation, each supporting up to 100 domains independently - Published-date filtering: ISO-8601 UTC date range bounds via
filters.publishedDateFilter.from(inclusive earliest) andfilters.publishedDateFilter.to(inclusive latest), both optional with omitted filters preserving existing behavior - Merge logic: Admin and runtime include lists combine via intersection (only domains present in both survive); exclude lists combine via union (a domain blocked at either level remains blocked); runtime cannot expand admin scope
- Server-side enforcement: The entire filtering lifecycle—query execution, merge, compliance enforcement, and result verification—occurs server-side with no client-side filtering loops, post-processing, or additional roundtrips
- Regional expansion: Web Search now available in eu-west-1 (Dublin) and ap-northeast-1 (Tokyo), with AgentCore's zero-egress architecture ensuring search queries remain within AWS infrastructure
Industry Insight
- Enterprises building grounded AI agents will benefit from the admin-plus-runtime layered model, which eliminates the need for custom orchestration logic while maintaining strict governance—this pattern will likely become a standard expectation for enterprise AI platforms
- The regional expansion to Dublin and Tokyo addresses data sovereignty and latency concerns for regulated customers in Europe and Asia Pacific, potentially accelerating agent adoption in industries with strict data residency requirements like finance and healthcare
- Multi-tenant SaaS platforms can now dynamically tailor search scope per customer request without provisioning separate connector resources, reducing operational complexity and enabling more flexible, cost-effective agent architectures
Disclaimer: The above content is generated by AI and is for reference only.