A refund assistant whose only rule is a sentence in its prompt will issue a CNY 3000 refund the moment a customer insists: the sentence is a suggestion, not a gate. This article replaces the sentence with a Cedar policy on an AgentCore Gateway and proves it three ways: the same CNY 3000 call runs anyway while the policy engine writes DENY beside it, one mode switch kills it at the gateway with a 47-millisecond decision, and it stays dead when called directly, no agent in the loop. CNY 200 passes every gate untouched, no code changed between verdicts. Every number was measured in one account, us-east-1 .

The use case

A customer asks Meridian Supply's refund assistant to refund order SO-2214 for CNY 3000, and the business rule says refunds stop at CNY 500. The prompt asks it to confirm the amount, and it does: the customer confirms CNY 3000, the assistant calls processRefund, the refund is issued. The baseline measured exactly that: CNY 200 returned RF-2772878660 , CNY 3000 returned RF-2772903637 .…