feat: add policy engine and policy support by jesseturner21 · Pull Request #579 · aws/agentcore-cli

jesseturner21 · 2026-03-19T22:32:57Z

Description

Adds full policy engine and policy primitive support to the AgentCore CLI, including schema definitions, CLI commands, TUI wizards, deploy pipeline integration, and removal flows.

Key changes:

New primitives: PolicyEnginePrimitive and PolicyPrimitive with full add/remove lifecycle
Schema: New Zod schemas for policy engines and policies (project spec, deployed state, MCP config)
TUI: Add policy engine screen, add policy wizard (with statement editor, source file, and Bedrock generation), policy engine selection in gateway wizard
CLI commands: add policy-engine, add policy (with --statement, --source, --generate mutually exclusive flags), remove policy-engine, remove policy
Deploy pipeline: Preflight validation, CloudFormation output parsing, and status display for policy engines/policies
Gateway integration: PolicyEngineConfiguration wiring to associate policy engines with gateways
Remove flow: Composite key handling for cross-engine policy name collisions, policy engine/policy removal screens
Tests: Integration test for add/remove policy flow, unit tests for outputs, remove hooks, and validation

Related Issue

N/A

Documentation PR

Type of Change

Bug fix
New feature
Breaking change
Documentation update

Testing

How have you tested the change?

I ran npm run test:unit and npm run test:integ
I ran npm run typecheck
I ran npm run lint
If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Checklist

I have read the CONTRIBUTING document
I have added any necessary tests that prove my fix is effective or my feature works
I have updated the documentation accordingly
I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
My changes generate no new warnings
Any dependent changes have been merged and published

Note: This PR depends on the corresponding agentcore-l3-cdk-constructs PR for the CDK PolicyEngine/Policy constructs.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

jesseturner21 · 2026-03-19T22:42:14Z

📦 Package Tarball

aws-agentcore-0.3.0-preview.6.0.tgz

How to install

npm install https://github.com/jesseturner21/agentcore-cli/releases/download/pr-579-tarball/aws-agentcore-0.3.0-preview.6.0.tgz

Note: The automated pr-tarball workflow cannot create releases on the upstream repo from fork PRs. This tarball was uploaded to the fork repo instead.

aidandaly24

Have some comments many are nit/suggestions

Add Cedar authorization policy support to AgentCore CLI: - Schema: PolicyEngine and Policy schemas with Zod validation - TUI: Full add/remove wizards for policy engines and policies - Source methods: Cedar file, inline statement, or AI generation - Gateway selection for generation flow - Expandable text input for generation prompts - CLI: Non-interactive add/remove commands with all flags - agentcore add policy-engine --name <name> - agentcore add policy --name <name> --engine <engine> --source/--statement/--generate - agentcore remove policy-engine/policy --name <name> - Deploy: CDK construct integration, CloudFormation output parsing, deployed state tracking with composite engine/policy keys - Status: Policy engines and policies shown in status command and ResourceGraph TUI with correct deployment state diffing - Generation: StartPolicyGeneration + waiter integration with deployed engine ID and gateway ARN resolution - Validation: Schema validation for names, statements, validation modes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…e collisions Policies are nested under engines, so the same policy name can exist in multiple engines. Switch getRemovable/remove/previewRemove to use an "engineName/policyName" composite key so the generic TUI remove flow can uniquely identify policies with a single string. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Regenerate lock file with npm@10 to resolve missing yaml@2.8.2 dependency entry that caused `npm ci` failures on Node 20.x and 22.x. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Merge duplicate imports in policy-generation.ts - Use dot notation instead of bracket notation in outputs test - Replace Array<T> with T[] in outputs.ts and useDeployFlow.ts - Add void operator for floating promises in AddPolicyFlow - Wrap async handlers with void for no-misused-promises - Escape quotes in JSX text in AddPolicyScreen - Fix prettier formatting across all changed files Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

… policy Previously, passing multiple source flags (e.g. --statement + --source) was silently accepted with an implicit precedence order. Now the command returns a clear error if more than one is provided. Also fix pre-existing type errors in dev config tests by adding the required policyEngines field to test fixtures. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add interactive TUI support for removing policy engines and policies, including menu entries, selection screens, confirmation, and success states. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…h credentials The createManagedOAuthCredential method was only writing the client secret with an incorrect env var name. Now correctly writes both _CLIENT_ID and _CLIENT_SECRET suffixed env vars, matching the pattern used by CredentialPrimitive. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The "Generate a Cedar policy" option's disabled description was too long ("Requires deployed engine — run `deploy` first") and got cut off in narrow terminals. Shortened to "Deploy engine first". Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…error When the policy generation API returned an error, pressing Escape on the review step would loop back to the loading step and re-trigger the API call, creating an infinite loop. The root cause was the double goBack() pattern (one immediate, one via setTimeout) suffering from stale closures — both calls saw the same step, so the second never reached the description step, while the first landed on loading and re-fired the useEffect. The fix uses a skipGeneration ref: when navigating back from review, the ref is set to true and a single goBack() moves to the loading step. The useEffect detects the ref, resets it, and calls goBack() again (now with the correct step in scope) to reach the description step — without ever starting generation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The CDK constructs renamed McpGateway to Gateway in PR #65. No deployed stacks use the old prefix since this is pre-GA. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…usivity Cover all pairwise combinations and the triple-flag case to ensure the CLI rejects conflicting policy source flags. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The sourceFile field is metadata tracking where a policy statement originated. The statement itself is persisted in agentcore.json, so the original .cedar file is not needed after add. Failing validation when the source file is cleaned up is incorrect. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The remove action always output JSON regardless of whether --json was passed. Now matches the add command behavior: plain text by default, JSON only when --json is specified. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Validate --validation-mode CLI flag with ValidationModeSchema.parse() instead of unsafe cast (PolicyPrimitive) - Add ambiguity check in remove/previewRemove when policy exists in multiple engines without --engine specified (PolicyPrimitive) - Gate JSON output behind --json flag in policy engine remove (PolicyEnginePrimitive) - Add uniqueBy validation on policies array to prevent duplicate names (policy schema) - Narrow validationModeItems type to remove unnecessary cast (AddPolicyScreen) - Disable reviewNav when generation error is shown (AddPolicyScreen) - Add expandable to inline Cedar statement TextInput (AddPolicyScreen) - Check waiter result state before proceeding (policy-generation) - Revert SelectList wrap from truncate back to wrap Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jesseturner21 requested a review from a team March 19, 2026 22:32

jesseturner21 had a problem deploying to e2e-testing March 19, 2026 22:33 — with GitHub Actions Failure

github-actions bot added the size/xl PR size: XL label Mar 19, 2026

jesseturner21 force-pushed the main branch from 36dfa19 to f4040ee Compare March 19, 2026 22:34

github-actions bot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 19, 2026

jesseturner21 had a problem deploying to e2e-testing March 19, 2026 22:36 — with GitHub Actions Failure

github-actions bot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 20, 2026

jesseturner21 had a problem deploying to e2e-testing March 20, 2026 18:17 — with GitHub Actions Failure

github-actions bot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 20, 2026

jesseturner21 had a problem deploying to e2e-testing March 20, 2026 20:29 — with GitHub Actions Failure

jesseturner21 force-pushed the main branch from 9504b59 to f6848fa Compare March 22, 2026 16:49

github-actions bot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 22, 2026

jesseturner21 had a problem deploying to e2e-testing March 22, 2026 16:49 — with GitHub Actions Failure

jesseturner21 had a problem deploying to e2e-testing March 23, 2026 03:20 — with GitHub Actions Failure

github-actions bot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 23, 2026

jesseturner21 had a problem deploying to e2e-testing March 23, 2026 03:57 — with GitHub Actions Failure

github-actions bot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 23, 2026

jesseturner21 had a problem deploying to e2e-testing March 23, 2026 04:00 — with GitHub Actions Failure

github-actions bot removed the size/xl PR size: XL label Mar 23, 2026

Hweinstock reviewed Mar 23, 2026

View reviewed changes

Comment thread integ-tests/add-remove-policy.test.ts

Comment thread src/cli/tui/screens/policy/AddPolicyScreen.tsx Outdated

Comment thread src/cli/primitives/PolicyEnginePrimitive.ts

Comment thread src/cli/primitives/GatewayPrimitive.ts

aidandaly24 requested changes Mar 23, 2026

View reviewed changes

github-actions bot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 23, 2026

jesseturner21 had a problem deploying to e2e-testing March 23, 2026 15:31 — with GitHub Actions Failure

jesseturner21 and others added 17 commits March 23, 2026 11:39

fix: sync package-lock.json for npm@10 compatibility

0bc9914

Regenerate lock file with npm@10 to resolve missing yaml@2.8.2 dependency entry that caused `npm ci` failures on Node 20.x and 22.x. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: add policy engine and policy support to TUI remove flow

c61bfce

Add interactive TUI support for removing policy engines and policies, including menu entries, selection screens, confirmation, and success states. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: add PolicyEngineConfiguration support for gateways

d642bd7

feat: add policy engine selection to gateway TUI wizard

0486995

chore: remove legacy McpGateway output pattern from gateway parser

17997d6

The CDK constructs renamed McpGateway to Gateway in PR #65. No deployed stacks use the old prefix since this is pre-GA. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test: add integ tests for --statement/--source/--generate mutual excl…

2f90d2b

…usivity Cover all pairwise combinations and the triple-flag case to ensure the CLI rejects conflicting policy source flags. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: respect --json flag in policy remove command

62a73a1

The remove action always output JSON regardless of whether --json was passed. Now matches the add command behavior: plain text by default, JSON only when --json is specified. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: co-locate hasPolicyEngines with other has* checks in preflight

900810a

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jesseturner21 force-pushed the main branch from 7b0fe1e to d0a4df2 Compare March 23, 2026 15:40

github-actions bot added size/xl PR size: XL and removed size/xl PR size: XL labels Mar 23, 2026

jesseturner21 had a problem deploying to e2e-testing March 23, 2026 15:40 — with GitHub Actions Failure

aidandaly24 approved these changes Mar 23, 2026

View reviewed changes

jesseturner21 merged commit 4da709b into aws:main Mar 23, 2026
17 of 18 checks passed

This was referenced Mar 23, 2026

feat(gateway): add custom claims validation and TUI wizard for JWT auth #599

Merged

feat!: merge mcp.json into agentcore.json #605

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add policy engine and policy support#579

feat: add policy engine and policy support#579
jesseturner21 merged 17 commits intoaws:mainfrom
jesseturner21:main

jesseturner21 commented Mar 19, 2026

Uh oh!

jesseturner21 commented Mar 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aidandaly24 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jesseturner21 commented Mar 19, 2026

Description

Related Issue

Documentation PR

Type of Change

Testing

Checklist

Uh oh!

jesseturner21 commented Mar 19, 2026

📦 Package Tarball

How to install

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aidandaly24 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants