AgentCore Web Search Gains Per-Call Domain and Date Filters
In this article
Amazon Bedrock AgentCore's Web Search tool gained two new per-request filtering mechanisms on 19 August 2026, shipped as part of web-search connector version 1.2.0. Developers can now pass domain allowlists or denylists and ISO-8601 UTC publication-date bounds directly in every tools/call invocation, with enforcement handled server-side inside AgentCore Gateway before results reach the model. The same release expands Web Search regional availability to eu-west-1 (Dublin) and ap-northeast-1 (Tokyo), joining the existing us-east-1 (N. Virginia) endpoint.
For anyone building agents with layered control requirements, this matters because org-wide admin policies set at target creation time are coarse instruments, and post-retrieval client-side filtering introduces extra roundtrips and leaves stale or off-domain content in the model's context window longer than necessary. Runtime filtering moves enforcement to the retrieval layer itself.
What the filters object adds in version 1.2.0
The new filters object sits alongside the existing query and maxResults fields in the Web Search tool input schema. It exposes two sub-objects:
filters.domainFilter.include— allowlist; only results from listed domains are returned.filters.domainFilter.exclude— denylist; results from listed domains are suppressed.filters.publishedDateFilter.from— inclusive lower bound on publication date, ISO-8601 UTC.filters.publishedDateFilter.to— inclusive upper bound on publication date, ISO-8601 UTC.
Both the include and exclude lists support up to 100 domains each, counted independently. Both filters are optional; omitting them preserves pre-1.2.0 behaviour. When a date filter is active, results without a recognised publication date are excluded rather than returned unverified — the system trades recall for precision deliberately.
The admin-plus-runtime merge model
The most consequential design decision is the merge logic between admin-level policies (set during create_gateway_target or update_gateway_target) and runtime filters passed per call:
| Filter type | Merge operation | Effect |
|---|---|---|
| Domain include (allowlist) | Intersection | Only domains present in both the admin list and the runtime list are searched. A domain in the runtime list that the admin never allowed is silently dropped. |
| Domain exclude (denylist) | Union | A domain blocked at either the admin or runtime level stays blocked. Runtime callers cannot unblock what an admin has denied. |
| Published-date filter | Per-call only | No admin-level date policy exists; the runtime caller sets the full date window each invocation. |
If an admin configures [approved-wire-1.com, approved-wire-2.com, sec.gov, investor.gov] as the include list and a runtime call passes [sec.gov], only sec.gov is searched. Passing some-other-site.com at runtime produces no error but also no results from that domain — it is silently dropped. Runtime filters can narrow the search space but never expand it past what the admin has sanctioned.
This matters especially for multi-tenant SaaS platforms. Rather than provisioning a separate gateway target per tenant — the source material describes a scenario with 200 tenants — operators can maintain a single target with a broad admin allowlist and apply per-tenant domain policies dynamically at tools/call time. Note that passing filters via system prompt alone is not hard enforcement; filters passed directly in the tools/call payload provide API-level enforcement the model cannot bypass.
API invocation and IAM prerequisites
Invoking the feature requires an AgentCore Gateway with a Web Search target pinned to connector version 1.2.0 or later. Existing targets on version 1.1.0 can migrate via UpdateGatewayTarget without creating a new target. Two IAM permissions are required: the calling agent or application needs bedrock-agentcore:InvokeGateway on the gateway ARN, and the Gateway's service role needs bedrock-agentcore:InvokeWebSearch.
A concrete SEC enforcement-action scenario illustrates the call structure: the tools/call payload sets filters.domainFilter.include to ["sec.gov"] and filters.publishedDateFilter from 2026-07-01T00:00:00Z to 2026-08-04T23:59:59Z. The agent receives only results from sec.gov published within that five-week window — third-party legal commentary and historical filings are excluded before the model sees any content.
The tool name in the tools/call request follows the pattern <target-name>___WebSearch; for a target named web-search-filtered, that is web-search-filtered___WebSearch, discoverable via tools/list. SDK support covers Python (Boto3), JavaScript/TypeScript, Java, .NET, Go, Ruby, and PHP, plus the AWS CLI and AgentCore CLI. The AWS Console surfaces both include and exclude domain-list inputs in the connector configuration UI. Version 1.2.0 is a minor release; the filters object is additive and existing calls without filters continue to work unchanged.
The regional expansion and filtering capability together position AgentCore as infrastructure for regulated-industry deployments where source provenance and data locality are compliance requirements. Zero-egress architecture — search queries served entirely within AWS infrastructure without routing to a third-party search engine — was already a design constraint; runtime filtering brings the same governance posture down to the individual API call.