Governing AI agent tool quotas with AWS Agent Registry and Amazon Bedrock AgentCore Gateway

Prashanth Sivarajan, Amazon Web Services

Summary

AWS Agent Registry is a centralized catalog within Amazon Bedrock AgentCore that lets organizations register, discover, and govern AI agents, MCP servers, and the tools they expose. It stores rich metadata - including custom fields - on each registry record, supports lifecycle statuses (draft, approved, deprecated), and emits events as records change, giving platform teams a single control plane for the growing fleet of AI agents and tools in their environment.

As organizations scale to dozens or hundreds of AI agents, ungoverned tool access creates operational and financial risk. Without per-tool quotas, a single misconfigured agent can saturate a downstream API or drive unexpected costs, and there is no centralized place to define, approve, or audit those limits.

This pattern uses Agent Registry as a policy-as-metadata layer. You define quota policies (calls per hour, cost tier, burst limits) as custom metadata on tool records, use EventBridge-driven approval workflows to gate tool discoverability, and deploy a Gateway REQUEST interceptor that reads quota metadata and enforces limits with DynamoDB sliding-window counters. This gives platform teams a single, auditable control point that prevents runaway costs and protects shared infrastructure - without modifying agent code.

Prerequisites and limitations

Prerequisites

Preview notice: AWS Agent Registry is in Preview (launched April 2026). APIs, event schemas, and service limits described in this pattern may change before general availability. Do not use Preview services for production workloads that require stable API contracts. Verify all API names and behaviors against the current documentation before implementation.

Limitations

Preview service: AWS Agent Registry is in Preview (April 2026). The limitations below reflect Preview behavior and may change at GA.

Architecture

The architecture uses AWS Agent Registry as the single source of truth for tool quota policies. Custom metadata schemas on registry records declare rate limits, cost tiers, and burst allowances. A Gateway REQUEST interceptor reads these policies at invocation time and enforces them with DynamoDB-backed sliding-window counters. EventBridge notifications trigger approval workflows that validate quota policies before tools become discoverable.

Runtime quota enforcement

Governance and approval workflow

Cost considerations

Tools

Best practices

Quota metadata design

Rate-limiting strategy

Governance workflow

Security and observability

Epics

{
  "schema_version": "1.0",
  "quotas": {
    "standard": {
      "calls_per_hour": 100,
      "burst_limit": 20,
      "cooldown_seconds": 60
    },
    "premium": {
      "calls_per_hour": 1000,
      "burst_limit": 200,
      "cooldown_seconds": 10
    }
  },
  "cost_tier": "medium",
  "rate_limit_strategy": "sliding_window"
}

{
  "tool_quotas": {
    "query_database": {
      "calls_per_hour": 50,
      "cost_tier": "high"
    },
    "list_items": {
      "calls_per_hour": 500,
      "cost_tier": "low"
    }
  }
}

{
  "source": ["aws.bedrock-agentcore"],
  "detail-type": ["Registry Record State changed to Pending Approval"]
}

return {"interceptorOutputVersion": "1.0",
        "mcp": {"transformedGatewayRequest": {"body": request_body}}}

raise Exception(json.dumps({
    "error": "Rate limit exceeded",
    "tool": tool_name,
    "retry_after_seconds": cooldown_seconds,
}))

import * as agentcore from 'aws-cdk-lib/aws-bedrockagentcore';

const gateway = new agentcore.Gateway(this, 'QuotaGateway', {
  gatewayName: 'tool-quota-gw',
  authorizerConfiguration: agentcore.GatewayAuthorizer.usingAwsIam(),
  exceptionLevel: agentcore.GatewayExceptionLevel.DEBUG,
  interceptorConfigurations: [
    agentcore.LambdaInterceptor.forRequest(quotaInterceptorFn, { passRequestHeaders: true }),
  ],
});

estimated_usage = previous_count × (1 - minute/60) + current_count

Troubleshooting

Related resources

Additional information

All epics and stories above are fully implemented in the code repository, except those marked as (recommendation) - which are operational best practices you should adopt but are not automated by the sample code.

Quota metadata schema reference

The quota metadata JSON schema defines the structure for tool rate limits stored as custom metadata on Agent Registry records. It is introduced in Epic 1 (Story 1.1) and enforced at runtime by the interceptor (Epic 3, Story 3.2) and the validation workflow (Epic 2, Story 2.2).

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "ToolQuotaMetadata",
  "type": "object",
  "required": ["schema_version", "quotas", "cost_tier"],
  "properties": {
    "schema_version": {
      "type": "string",
      "pattern": "^\\d+\\.\\d+$"
    },
    "quotas": {
      "type": "object",
      "patternProperties": {
        "^(standard|premium|enterprise)$": {
          "type": "object",
          "required": ["calls_per_hour"],
          "properties": {
            "calls_per_hour": { "type": "integer", "minimum": 1 },
            "burst_limit": { "type": "integer", "minimum": 1 },
            "cooldown_seconds": { "type": "integer", "minimum": 0 }
          }
        }
      }
    },
    "cost_tier": {
      "type": "string",
      "enum": ["low", "medium", "high", "premium"]
    },
    "tool_quotas": {
      "type": "object",
      "description": "Per-tool overrides within an MCP server record",
      "additionalProperties": {
        "type": "object",
        "properties": {
          "calls_per_hour": { "type": "integer" },
          "cost_tier": { "type": "string" }
        }
      }
    }
  }
}

FAQs

What happens if the Agent Registry is unreachable? The interceptor fails open - requests are allowed when the registry cannot be queried. This avoids blocking agents during transient outages. To implement fail-closed behavior, modify the interceptor to deny requests when the registry returns an error, accepting the tradeoff of agent disruption during outages.

How long do quota policy changes take to propagate? Agent Registry metadata is eventually consistent (a few seconds), and the interceptor caches quota data for 60 seconds. In the worst case, changes take up to ~65 seconds to take effect.

Can different agents have different quotas for the same tool? Yes. The override table (Epic 5, Story 5.3) stores per-agent quota overrides. Priority order: agent-specific override > tool-level quota > default quota tier. Insert a record into the QuotaOverrides DynamoDB table with agent_id, tool_name, and the fields to override (e.g., calls_per_hour, burst_limit).

Is the rate limiter exactly accurate under high concurrency? DynamoDB counter updates use atomic ADD operations, but the read-then-decide-then-write flow is not transactional. Under high concurrency, a small number of requests may slip through before the counter reflects the true count. For strict enforcement, use DynamoDB conditional writes with a version attribute.

Attachments

To access additional content that is associated with this document, download and unzip the following file: attachment.zip