Are MCP prompts supported in Cedar policies on AgentCore Gateway?

Question

I have an AgentCore Gateway deployed with protocol_type=MCP, the target behind this is a simple python app using FastMCP.

Here's a snippet of the code:
```
@mcp.prompt()
def analyze_data(dataset: str, timeframe: str = "1h") -> str:
    """Generate a structured prompt for data analysis."""
    return f"""You are an expert Data Analyst.

Dataset: {dataset}
Timeframe: last {timeframe}

Please:
1. Summarize the content of the dataset
2. Identify any patterns /anomalies
3. Explain the significance of the findings
"""
```

I can list this prompt and call it from an MCP client (claude code) but I see my calls blocked by policy.

The configured Cedar policy (which should be a blanket Allow for a given scope) is:
```
permit (
    principal is AgentCore::OAuthUser,
    action,
    resource ==
        AgentCore::Gateway::""
)
when
{ principal.hasTag("scope") && principal.getTag("scope") like "*mcp:read*" };
```

If I set the policy engine to`LOG_ONLY` I see that my `prompts/get` calls get an `UNKNOWN` policy decision.
It seems that the prompt call is not recognised as a valid action.

Is this expected or is there an issue with my cedar policy?

Florian Turnwald · Answer

I think the UNKNOWN decision in LOG_ONLY mode points to a schema mapping mismatch rather than a logic flaw in your Cedar policy.

Cedar authorization requires all actions to be explicitly defined in its strictly typed .cedarschema. Currently, the AgentCore Gateway is heavily optimized for tool-level access control. When your client makes a prompts/get or prompts/list request, the gateway attempts to evaluate an action against Cedar (e.g., AgentCore::Action::"prompts/get") that likely does not exist in the managed gateway's underlying schema.

Because the action is undefined within that specific environment, Cedar cannot evaluate it against your blanket allow (permit(principal, action, resource)). This results in an incomplete evaluation state, logged as UNKNOWN.

**Actionable Workaround:**
Until the gateway natively maps the MCP prompts namespace in its schema, the most reliable path is to refactor your @mcp.prompt() into a standard @mcp.tool(). This changes the JSON-RPC call to tools/call, which is explicitly recognized by the gateway's schema and will be successfully permitted by your current policy.

Are MCP prompts supported in Cedar policies on AgentCore Gateway?

Add your answer

Relevant content