AWS says an agent can work without a person approving each step, if its rules can be checked. Your teams have to write those rules first.

Trust limits how much freedom companies give agents, and "human in the loop" has become the standard answer. That answer works until the approvals pile up, because people who review a long queue stop catching the mistakes that matter. Shawn Bice, VP at AWS (Agentic Al / previously databases, analytics & ML), at Amazon Web Services, offers a different route in his Trust in Depth post: a rule stated precisely can be checked by math, so a person no longer has to judge each case. People keep the calls that need judgment, and the agent works alone where its rules can be checked.

Test the rules before the agent runs

AWS uses a kind of math called automated reasoning to test whether a rule holds in every possible case. Tests check the cases someone imagined, and an agent picks its own route on each run. AWS has used this math for more than a decade, including on its access control service, which handles more than 2.1 billion requests per second (AWS Blog, 2026).

In Amazon Bedrock AgentCore, you write the rules in plain language. The system checks them for gaps and contradictions before they take effect. Every tool call the agent makes through the AgentCore gateway then passes a checkpoint that enforces the rules, and the agent cannot switch that checkpoint off.

Write rules a computer can check

Bice gives two examples. "Only a manager can approve access" is a rule the math can check. "Keep a friendly tone" is a goal that falls outside it. For goals like that, AWS suggests narrow access and scoring of the agent's work, with a person handling the unclear cases.

Two rules kept an offboarding agent in line

Bice's example is a help desk agent that offboards Sam, an employee who is leaving. The agent has three jobs:

• Cut off Sam's access.
• Hand his mailbox to a successor.
• Free up his license.

His emails may also matter in a legal dispute, so the order of the steps counts.

Two rules cover the job:

• The agent blocks Sam's sign-in before it moves his mailbox.
• The agent checks for a legal hold before it changes his license.

The checkpoint stopped the agent twice, once when it tried to move the mailbox before blocking sign-in and once when it tried to change the license before checking for a hold. The agent fixed both, and the evidence stayed protected. Nobody scripted the sequence. The rules set the prerequisites, and the agent worked through them after each blocked attempt.

The agent also had six tools, and none could delete an account.

Every control in the offboarding example was a human decision made before the agent ran.

Sort your rules before you call AWS

Take the first workflow you want to run without an approval queue, then work through two steps:

1. List what the workflow has to follow and mark each item as a clear rule or a judgment call.
2. Start with rules about order, like the two above, where one step must finish before the next begins.

Order rules are short to state and suit this kind of check, as both examples show, and getting security, messaging, legal and finance to agree on them is your job.

Then ask what each proof assumes. The sign-in rule works only if two things hold:

• Every tool call is routed through the checkpoint.
• The block-sign-in tool does what its name says.

Each assumption needs an owner on your team, because the proof is only as strong as the weakest one. Ask AWS as well what the checkpoint does with an action that no rule mentions.

Weigh what AWS adds against other options

Two things set the AWS post apart:

• The proof step. AWS checks your rules for gaps and contradictions before they take effect, using the same math it runs in its access control service. Gravitee and a March 2026 draft from the Internet Engineering Task Force describe enforcing rules at a checkpoint, and I found no description of checking the rules themselves in the material I reviewed. AWS has used the math on its own systems for years, so the technique has a track record. Applying it to agent rules is newer, and your pilot will show how it holds up.
• The framing. Bice borrows the name from Defense in Depth, the layered security practice the industry has used for two decades, and points the same layering at widening what you can safely allow. That gives a CIO a clear way to discuss autonomy, and the new technology sits in the proof step.

Bice invites any company running agents, on any platform, to answer the same questions. If your agents run on more than one cloud, ask what you can prove outside AWS.