AgentCore web search filters need a connector-version gate

Pin the connector and discovered contract

Record the gateway and target identifiers, AWS account and region, connector ID, explicitly pinned connector version, provisioning time, tool name, complete input and output schemas returned by tools/list, execution role, owner, approval, and the workloads allowed to call it. Compare that discovered contract with the policy assumed by the application. A user interface that offers domain or date restrictions cannot establish that the target actually accepts those fields, and a current documentation page cannot establish which version is deployed. Block release when the target is unpinned, when filters are absent from the discovered schema, or when an application silently drops an unknown property. Preserve the former schema and change receipt whenever the connector, gateway, client library, or agent definition changes.

Resolve filter precedence before retrieval

Define the approved source universe at the target, then state which callers may narrow it per request. AWS says request filters are applied on top of target include and exclude lists; the buyer still needs tested rules for overlap, root-domain and subdomain matching, redirects, aliases, international domains, URL shorteners, mirrors, cached documents, and a request that supplies both inclusion and exclusion. Publication-date bounds apply to web results and depend on available date metadata, so an undated page or a misleading publisher date needs an explicit treatment rather than an inferred pass. Do not let a model invent or broaden filter fields. Log the effective normalized lists and bounds used for each search without storing sensitive query content beyond the declared purpose.

Test policy with hostile and missing metadata

Build a frozen test set containing allowed authorities, prohibited domains, matching and nonmatching subdomains, redirected pages, mixed-date results, pages without dates, stale pages carrying fresh update labels, adversarial titles and snippets, and sources that disappear between search and use. Run the same set with a pre-1.2.0 schema, the approved pinned version, a changed target list, and caller-supplied filters. Verify returned URLs, titles, dates, snippets, structured fields, citations, and the agent's final answer—not only whether the tool call succeeded. A filtered result set is not necessarily authoritative or complete, and Amazon's index or knowledge graph claim is not buyer evidence for a given question. Route missing, contradictory, or outside-policy evidence to an explicit unknown instead of allowing the model to fill the gap.

Gate every upgrade on retrieval-policy replay

Start with a bounded research use case whose answers remain advisory and require source inspection. Predeclare acceptable source types, freshness rules, excluded domains, unknown handling, citation requirements, latency, cost, and rollback conditions. Before a connector or target update, replay the frozen corpus and compare discovered schema, effective filters, result membership, date handling, citation traceability, and downstream answers. Canary the change, keep the previous target version addressable where the service permits, and stop if a prohibited source appears, an allowed authority disappears without explanation, filters are ignored, or provenance cannot be reconstructed. High-consequence uses need an independent authoritative record and named human decision; web search should supply evidence for review, not silently become the enterprise system of record.

Turn this source into a reviewable decision

For AI for CIOs, use this briefing as a dated decision record rather than a substitute for the source. Preserve Web Search Tool, the exact URL, the September 8, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Enterprise knowledge retrieval; Enterprise AI platform architecture; Software delivery and modernization; Operations and incident intelligence. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.

Limitations and unknowns

This briefing uses AWS's official current AgentCore Web Search Tool documentation, checked September 8, 2026. The page is undated and treated as a cutoff-timing evidence gap, not a verified post-cutoff change. It establishes AWS's documented connector-version and schema distinctions, filter fields, data-path description, and provider claims; it does not prove a buyer's deployed version, target configuration, effective filtering, index coverage or freshness, publication-date correctness, source authority, snippet fidelity, citation completeness, response accuracy, privacy, reliability, cost, or production suitability. AWS services, connector versions, schemas, index behavior, regions, and documentation can change. Current service documentation and contracts, deployed target and schema exports, filter and retrieval tests, query-data handling, rollback evidence, and qualified architecture, knowledge-management, security, privacy, resilience, procurement, accessibility, records, legal, and service-owner review control.