Separate model access from tool authority

The prompt

If you're using (or considering) Amazon Bedrock for governed model access, write out exactly what the model can decide vs. what IAM, identity, gateway, and policy actually decide on its behalf. Is that split enforced in code, or only in a document?

Why it's built that way

Amazon Bedrock provides a governed model-access layer for Claude and other foundation models — keep model inference separate from tool authority. The model can decide what it wants to do; IAM, AgentCore Identity, Gateway, Policy, and downstream systems decide whether the action is allowed.

What to do with the answer

If the split only exists in a document, that's the gap — enforce it with an actual IAM boundary this week.