Defender Impact
AWS’s Trust in Depth framework directly addresses one of the most persistent governance gaps in production agentic AI deployments: the absence of a structured, policy-enforced middle ground between fully supervised and fully autonomous agent operation. For security teams, this represents a concrete mechanism to apply least-privilege principles to AI agents — a control class that has been conspicuously absent from most agentic platforms.
Capability Overview
Published via the AWS Machine Learning Blog, Trust in Depth is a design and control framework for Amazon Bedrock agents that introduces graduated autonomy tiers. Rather than treating agent autonomy as a binary setting, the framework allows operators to define policy-bounded trust levels that constrain what actions an agent can take, what tools it can invoke, and at what thresholds human confirmation is required before proceeding.
The framework appears to operate across three conceptual layers: the scope of tool access granted to an agent, the conditions under which the agent can act without human review, and the audit trail generated to support post-hoc accountability. By structuring these as configurable policy controls rather than model-level behaviours, AWS moves the governance of agent autonomy from implicit trust in model alignment to explicit, operator-defined enforcement — a meaningful architectural shift for enterprise deployments.
This is directly relevant to the OWASP LLM08 (Excessive Agency) risk, which describes the failure mode where an AI agent is granted more capability or autonomy than its task requires, creating an outsized blast radius in the event of manipulation, misconfiguration, or unexpected behaviour.
Defensive Advances
Least-privilege enforcement for agents. Defenders can now scope agent tool access to task-minimum permissions, reducing the surface area available to any agent that is manipulated through context poisoning or prompt injection upstream.
Auditable trust boundaries. Policy-defined autonomy tiers create structured, inspectable decision boundaries. Security teams gain a clear forensic record of what an agent was authorised to do — distinct from what it actually did — which is foundational for incident investigation in agentic pipelines.
Blast radius containment. By limiting the scope of autonomous action at the policy layer rather than relying on model-level self-restraint, organisations reduce the potential impact of a compromised or misbehaving agent in multi-agent orchestration chains.
Human-in-the-loop integration points. The graduated tier model provides natural integration points for human review workflows, allowing organisations to tune oversight intensity to risk tolerance without redesigning agent architectures.
Residual Gaps
Policy authorship maturity. The framework’s value is directly proportional to the quality of the trust policies operators define. Organisations without mature identity and access governance practices may find that their policies are too permissive by default, replicating existing excessive-agency risks under a new label.
No runtime behavioural anomaly detection. Trust in Depth appears to operate primarily at the static policy layer. There is no indication of runtime detection capability that flags when an agent’s behaviour — while technically within its authorised scope — is contextually anomalous. This gap means that sophisticated manipulation that stays within policy bounds would not be surfaced.
Cross-provider and cross-framework portability. The framework is Bedrock-native. Organisations running heterogeneous agentic stacks across multiple providers will need to implement equivalent controls elsewhere, and there is no indication of a shared standard that would enable interoperability.
Tooling for policy management at scale. As agent deployments grow from tens to hundreds of distinct agent roles, managing and auditing trust policies becomes a significant operational challenge. Tooling maturity for policy lifecycle management in agentic AI is still early.
Framework Mapping
- AML.T0080 (AI Agent Context Poisoning) and AML.T0110 (AI Agent Tool Poisoning): Policy-bounded tool access reduces the impact of successful poisoning by constraining what a manipulated agent can do.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation): Scoped tool permissions directly limit the exfiltration surface available to an agent operating under adversarial instructions.
- LLM08 (Excessive Agency): This is the primary OWASP category the framework addresses — graduated trust tiers are a direct structural response to this risk class.
Deployment Considerations
Organisations should treat Trust in Depth adoption as a two-phase exercise. In the first phase, audit existing agent deployments to establish a baseline of current tool access and autonomy scope — many teams will discover their agents are more permissive than their use cases require. In the second phase, define trust tier policies starting from minimum-necessary access and expanding only where operational requirements clearly justify it.
Complements to this framework include runtime observability tooling (to detect anomalous-but-authorised behaviour), integration with existing IAM governance processes, and incident response playbooks that account for agent-specific failure modes.
Defender Checklist
- Inventory all Bedrock agent deployments and document current tool access scope and autonomy settings
- Map each agent role to a minimum-necessary trust tier under the Trust in Depth framework
- Establish policy authorship and review as a formal security control with defined ownership
- Implement logging and alerting for agent tool invocations to support runtime visibility
- Define human-in-the-loop review thresholds for high-risk agent action classes
- Schedule periodic policy audits as agent capabilities and task scopes evolve
- Evaluate complementary runtime anomaly detection tooling to cover the behavioural gap