本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 使用带有策略的 AgentCore 网关 AgentCore
<a name="use-gateway-with-policy"></a>

按照网关授权和身份验证指南获取网关访问所需的凭证。

**仅限 MCP 工具**  
策略评估仅适用于 MCP 工具。无论策略评估模式如何，网关始终允许 MCP 提示 (`prompts/list`、`prompts/get`) 和资源 (`resources/list`、`resources/read`、`resources/templates/list`)。

**Topics**
+ [列出包含策略的 AgentCore 网关工具 AgentCore](#list-gateway-tools)
+ [带有策略的呼叫网关工具](#call-gateway-tools)
+ [传递临时策略的策略会话 ID](#use-gateway-policy-session-id)
+ [政策对策](#policy-responses)

## 列出包含策略的 AgentCore 网关工具 AgentCore
<a name="list-gateway-tools"></a>

工具列表被视为**元操作**。当委托人列出可用工具时，策略引擎不会评估特定工具调用的完整上下文（例如，输入参数）。

委托人只能在列表中查看政策允许他们调用的工具。由于工具调用的完整上下文在列表期间不可用，这意味着**如果存在允许调用该工具的任何情况，则允许委托人发布该工具**。

因此，列表中出现的工具并不能保证对该工具的后续调用会获得授权。实际工具调用的授权决策是使用完整的请求上下文（包括输入参数）单独评估的。

选择以下方法之一：

**Example**  

1. 

   ```
   curl -X POST \
     https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
       "jsonrpc": "2.0",
       "id": "list-tools-request",
       "method": "tools/list"
     }'
   ```

1. 

   ```
   import requests
   import json
   
   def list_tools(gateway_url, access_token):
       headers = {
           "Content-Type": "application/json",
           "Authorization": f"Bearer {access_token}"
       }
   
       payload = {
           "jsonrpc": "2.0",
           "id": "list-tools-request",
           "method": "tools/list"
       }
   
       response = requests.post(gateway_url, headers=headers, json=payload)
       return response.json()
   
   # Example usage
   gateway_url = "https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp"
   access_token = "YOUR_ACCESS_TOKEN"
   tools = list_tools(gateway_url, access_token)
   print(json.dumps(tools, indent=2))
   ```

   响应仅返回您的政策允许您查看的工具。被策略拒绝的工具不会出现在列表中。

## 带有策略的呼叫网关工具
<a name="call-gateway-tools"></a>

对您的网关进行工具调用。策略评估决定是允许还是拒绝呼叫。

选择以下方法之一：

**Example**  

1. 

   ```
   # Call a tool to test policy enforcement
   curl -X POST \
     https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
       "jsonrpc": "2.0",
       "id": "test-policy",
       "method": "tools/call",
       "params": {
         "name": "tool_name",
         "arguments": {"orderId": "12345"}
       }
     }'
   ```

1. 

   ```
   import requests
   import json
   
   def call_gateway_tool(gateway_url, access_token, tool_name, arguments):
       headers = {
           "Content-Type": "application/json",
           "Authorization": f"Bearer {access_token}"
       }
   
       payload = {
           "jsonrpc": "2.0",
           "id": "test-policy",
           "method": "tools/call",
           "params": {
               "name": tool_name,
               "arguments": arguments
           }
       }
   
       response = requests.post(gateway_url, headers=headers, json=payload)
       return response.json()
   
   # Example usage
   gateway_url = "https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp"
   access_token = "YOUR_ACCESS_TOKEN"
   result = call_gateway_tool(
       gateway_url,
       access_token,
       "RefundTool___process_refund",
       {
           "orderId": "12345",
           "amount": 450,
           "reason": "Defective product"
       }
   )
   print(json.dumps(result, indent=2))
   ```

## 传递临时策略的策略会话 ID
<a name="use-gateway-policy-session-id"></a>

要启用临时策略评估，请在请求中包含`x-amzn-bedrock-agentcore-policy-session-id`标头。这会将多个调用分组到一个会话中，以执行会话感知策略。

```
curl -X POST \
  https://mygateway-abcdefghij.gateway.bedrock-agentcore.us-west-2.amazonaws.com/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-amzn-bedrock-agentcore-policy-session-id: YOUR_SESSION_ID" \
  -d '{
    "jsonrpc": "2.0",
    "id": "test-temporal-policy",
    "method": "tools/call",
    "params": {
      "name": "tool_name",
      "arguments": {"orderId": "12345"}
    }
  }'
```

网关不会代表您生成会话 ID。从您的第一个请求开始，您必须生成会话 ID 并在每次请求时发送该会话 ID。如果您省略标头或发送空值，则网关不会建立会话。如果关联的策略引擎包含临时策略，则没有会话 ID 的请求会因验证错误而失败。在同一个会话中为每个请求发送相同的 ID。

## 政策对策
<a name="policy-responses"></a>

当策略允许请求时：

```
{
  "jsonrpc": "2.0",
  "id": "test-policy",
  "result": {
    "isError": false,
    "content": [
      {
        "type": "text",
        "text": "ToolResult"
      }
    ]
  }
}
```

当策略拒绝请求时：

```
{
  "jsonrpc": "2.0",
  "id": "test-policy",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "AuthorizeActionException - Tool Execution Denied: Tool call not allowed due to policy enforcement [No policy applies to the request (denied by default).]"
      }
    ],
    "isError": true
  }
}
```