aws-sdk-bedrockagentcorecontrol 1.14.0 → 1.16.0

data/lib/aws-sdk-bedrockagentcorecontrol/client.rb

@@ -566,6 +566,20 @@ module Aws::BedrockAgentCoreControl
     #         discovery_url: "DiscoveryUrl", # required
     #         allowed_audience: ["AllowedAudience"],
     #         allowed_clients: ["AllowedClient"],
+    #         allowed_scopes: ["AllowedScopeType"],
+    #         custom_claims: [
+    #           {
+    #             inbound_token_claim_name: "InboundTokenClaimNameType", # required
+    #             inbound_token_claim_value_type: "STRING", # required, accepts STRING, STRING_ARRAY
+    #             authorizing_claim_match_value: { # required
+    #               claim_match_value: { # required
+    #                 match_value_string: "MatchValueString",
+    #                 match_value_string_list: ["MatchValueString"],
+    #               },
+    #               claim_match_operator: "EQUALS", # required, accepts EQUALS, CONTAINS, CONTAINS_ANY
+    #             },
+    #           },
+    #         ],
     #       },
     #     },
     #     request_header_configuration: {
@@ -885,6 +899,107 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Creates a custom evaluator for agent quality assessment. Custom
+    # evaluators use LLM-as-a-Judge configurations with user-defined
+    # prompts, rating scales, and model settings to evaluate agent
+    # performance at tool call, trace, or session levels.
+    #
+    # @option params [String] :client_token
+    #   A unique, case-sensitive identifier to ensure that the API request
+    #   completes no more than one time. If you don't specify this field, a
+    #   value is randomly generated for you. If this token matches a previous
+    #   request, the service ignores the request, but doesn't return an
+    #   error. For more information, see [Ensuring idempotency][1].
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html
+    #
+    # @option params [required, String] :evaluator_name
+    #   The name of the evaluator. Must be unique within your account.
+    #
+    # @option params [String] :description
+    #   The description of the evaluator that explains its purpose and
+    #   evaluation criteria.
+    #
+    # @option params [required, Types::EvaluatorConfig] :evaluator_config
+    #   The configuration for the evaluator, including LLM-as-a-Judge settings
+    #   with instructions, rating scale, and model configuration.
+    #
+    # @option params [required, String] :level
+    #   The evaluation level that determines the scope of evaluation. Valid
+    #   values are `TOOL_CALL` for individual tool invocations, `TRACE` for
+    #   single request-response interactions, or `SESSION` for entire
+    #   conversation sessions.
+    #
+    # @return [Types::CreateEvaluatorResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CreateEvaluatorResponse#evaluator_arn #evaluator_arn} => String
+    #   * {Types::CreateEvaluatorResponse#evaluator_id #evaluator_id} => String
+    #   * {Types::CreateEvaluatorResponse#created_at #created_at} => Time
+    #   * {Types::CreateEvaluatorResponse#status #status} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.create_evaluator({
+    #     client_token: "ClientToken",
+    #     evaluator_name: "CustomEvaluatorName", # required
+    #     description: "EvaluatorDescription",
+    #     evaluator_config: { # required
+    #       llm_as_a_judge: {
+    #         instructions: "EvaluatorInstructions", # required
+    #         rating_scale: { # required
+    #           numerical: [
+    #             {
+    #               definition: "String", # required
+    #               value: 1.0, # required
+    #               label: "NumericalScaleDefinitionLabelString", # required
+    #             },
+    #           ],
+    #           categorical: [
+    #             {
+    #               definition: "String", # required
+    #               label: "CategoricalScaleDefinitionLabelString", # required
+    #             },
+    #           ],
+    #         },
+    #         model_config: { # required
+    #           bedrock_evaluator_model_config: {
+    #             model_id: "ModelId", # required
+    #             inference_config: {
+    #               max_tokens: 1,
+    #               temperature: 1.0,
+    #               top_p: 1.0,
+    #               stop_sequences: ["NonEmptyString"],
+    #             },
+    #             additional_model_request_fields: {
+    #             },
+    #           },
+    #         },
+    #       },
+    #     },
+    #     level: "TOOL_CALL", # required, accepts TOOL_CALL, TRACE, SESSION
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.evaluator_arn #=> String
+    #   resp.evaluator_id #=> String
+    #   resp.created_at #=> Time
+    #   resp.status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/CreateEvaluator AWS API Documentation
+    #
+    # @overload create_evaluator(params = {})
+    # @param [Hash] params ({})
+    def create_evaluator(params = {}, options = {})
+      req = build_request(:create_evaluator, params)
+      req.send_request(options)
+    end
+
     # Creates a gateway for Amazon Bedrock Agent. A gateway serves as an
     # integration point between your agent and external services.
     #
@@ -929,6 +1044,8 @@ module Aws::BedrockAgentCoreControl
     #
     #   * `AWS_IAM` - Authorize with your Amazon Web Services IAM credentials.
     #
+    #   * `NONE` - No authorization
+    #
     # @option params [Types::AuthorizerConfiguration] :authorizer_configuration
     #   The authorizer configuration for the gateway. Required if
     #   `authorizerType` is `CUSTOM_JWT`.
@@ -937,6 +1054,18 @@ module Aws::BedrockAgentCoreControl
     #   The Amazon Resource Name (ARN) of the KMS key used to encrypt data
     #   associated with the gateway.
     #
+    # @option params [Array<Types::GatewayInterceptorConfiguration>] :interceptor_configurations
+    #   A list of configuration settings for a gateway interceptor. Gateway
+    #   interceptors allow custom code to be invoked during gateway
+    #   invocations.
+    #
+    # @option params [Types::GatewayPolicyEngineConfiguration] :policy_engine_configuration
+    #   The policy engine configuration for the gateway. A policy engine is a
+    #   collection of policies that evaluates and authorizes agent tool calls.
+    #   When associated with a gateway, the policy engine intercepts all agent
+    #   requests and determines whether to allow or deny each action based on
+    #   the defined policies.
+    #
     # @option params [String] :exception_level
     #   The level of detail in error messages returned when invoking the
     #   gateway.
@@ -968,6 +1097,8 @@ module Aws::BedrockAgentCoreControl
     #   * {Types::CreateGatewayResponse#authorizer_type #authorizer_type} => String
     #   * {Types::CreateGatewayResponse#authorizer_configuration #authorizer_configuration} => Types::AuthorizerConfiguration
     #   * {Types::CreateGatewayResponse#kms_key_arn #kms_key_arn} => String
+    #   * {Types::CreateGatewayResponse#interceptor_configurations #interceptor_configurations} => Array&lt;Types::GatewayInterceptorConfiguration&gt;
+    #   * {Types::CreateGatewayResponse#policy_engine_configuration #policy_engine_configuration} => Types::GatewayPolicyEngineConfiguration
     #   * {Types::CreateGatewayResponse#workload_identity_details #workload_identity_details} => Types::WorkloadIdentityDetails
     #   * {Types::CreateGatewayResponse#exception_level #exception_level} => String
     #
@@ -986,15 +1117,46 @@ module Aws::BedrockAgentCoreControl
     #         search_type: "SEMANTIC", # accepts SEMANTIC
     #       },
     #     },
-    #     authorizer_type: "CUSTOM_JWT", # required, accepts CUSTOM_JWT, AWS_IAM
+    #     authorizer_type: "CUSTOM_JWT", # required, accepts CUSTOM_JWT, AWS_IAM, NONE
     #     authorizer_configuration: {
     #       custom_jwt_authorizer: {
     #         discovery_url: "DiscoveryUrl", # required
     #         allowed_audience: ["AllowedAudience"],
     #         allowed_clients: ["AllowedClient"],
+    #         allowed_scopes: ["AllowedScopeType"],
+    #         custom_claims: [
+    #           {
+    #             inbound_token_claim_name: "InboundTokenClaimNameType", # required
+    #             inbound_token_claim_value_type: "STRING", # required, accepts STRING, STRING_ARRAY
+    #             authorizing_claim_match_value: { # required
+    #               claim_match_value: { # required
+    #                 match_value_string: "MatchValueString",
+    #                 match_value_string_list: ["MatchValueString"],
+    #               },
+    #               claim_match_operator: "EQUALS", # required, accepts EQUALS, CONTAINS, CONTAINS_ANY
+    #             },
+    #           },
+    #         ],
     #       },
     #     },
     #     kms_key_arn: "KmsKeyArn",
+    #     interceptor_configurations: [
+    #       {
+    #         interceptor: { # required
+    #           lambda: {
+    #             arn: "LambdaFunctionArn", # required
+    #           },
+    #         },
+    #         interception_points: ["REQUEST"], # required, accepts REQUEST, RESPONSE
+    #         input_configuration: {
+    #           pass_request_headers: false, # required
+    #         },
+    #       },
+    #     ],
+    #     policy_engine_configuration: {
+    #       arn: "GatewayPolicyEngineArn", # required
+    #       mode: "LOG_ONLY", # required, accepts LOG_ONLY, ENFORCE
+    #     },
     #     exception_level: "DEBUG", # accepts DEBUG
     #     tags: {
     #       "TagKey" => "TagValue",
@@ -1019,13 +1181,29 @@ module Aws::BedrockAgentCoreControl
     #   resp.protocol_configuration.mcp.supported_versions[0] #=> String
     #   resp.protocol_configuration.mcp.instructions #=> String
     #   resp.protocol_configuration.mcp.search_type #=> String, one of "SEMANTIC"
-    #   resp.authorizer_type #=> String, one of "CUSTOM_JWT", "AWS_IAM"
+    #   resp.authorizer_type #=> String, one of "CUSTOM_JWT", "AWS_IAM", "NONE"
     #   resp.authorizer_configuration.custom_jwt_authorizer.discovery_url #=> String
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_audience #=> Array
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_audience[0] #=> String
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_clients #=> Array
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_clients[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_scopes #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_scopes[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].inbound_token_claim_name #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].inbound_token_claim_value_type #=> String, one of "STRING", "STRING_ARRAY"
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string_list #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string_list[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_operator #=> String, one of "EQUALS", "CONTAINS", "CONTAINS_ANY"
     #   resp.kms_key_arn #=> String
+    #   resp.interceptor_configurations #=> Array
+    #   resp.interceptor_configurations[0].interceptor.lambda.arn #=> String
+    #   resp.interceptor_configurations[0].interception_points #=> Array
+    #   resp.interceptor_configurations[0].interception_points[0] #=> String, one of "REQUEST", "RESPONSE"
+    #   resp.interceptor_configurations[0].input_configuration.pass_request_headers #=> Boolean
+    #   resp.policy_engine_configuration.arn #=> String
+    #   resp.policy_engine_configuration.mode #=> String, one of "LOG_ONLY", "ENFORCE"
     #   resp.workload_identity_details.workload_identity_arn #=> String
     #   resp.exception_level #=> String, one of "DEBUG"
     #
@@ -1155,6 +1333,26 @@ module Aws::BedrockAgentCoreControl
     #         mcp_server: {
     #           endpoint: "McpServerTargetConfigurationEndpointString", # required
     #         },
+    #         api_gateway: {
+    #           rest_api_id: "String", # required
+    #           stage: "String", # required
+    #           api_gateway_tool_configuration: { # required
+    #             tool_overrides: [
+    #               {
+    #                 name: "String", # required
+    #                 description: "String",
+    #                 path: "String", # required
+    #                 method: "GET", # required, accepts GET, DELETE, HEAD, OPTIONS, PATCH, PUT, POST
+    #               },
+    #             ],
+    #             tool_filters: [ # required
+    #               {
+    #                 filter_path: "String", # required
+    #                 methods: ["GET"], # required, accepts GET, DELETE, HEAD, OPTIONS, PATCH, PUT, POST
+    #               },
+    #             ],
+    #           },
+    #         },
     #       },
     #     },
     #     credential_provider_configurations: [
@@ -1167,6 +1365,8 @@ module Aws::BedrockAgentCoreControl
     #             custom_parameters: {
     #               "OAuthCustomParametersKey" => "OAuthCustomParametersValue",
     #             },
+    #             grant_type: "CLIENT_CREDENTIALS", # accepts CLIENT_CREDENTIALS, AUTHORIZATION_CODE
+    #             default_return_url: "OAuthDefaultReturnUrl",
     #           },
     #           api_key_credential_provider: {
     #             provider_arn: "ApiKeyCredentialProviderArn", # required
@@ -1217,6 +1417,17 @@ module Aws::BedrockAgentCoreControl
     #   resp.target_configuration.mcp.lambda.tool_schema.inline_payload[0].output_schema.items #=> Types::SchemaDefinition
     #   resp.target_configuration.mcp.lambda.tool_schema.inline_payload[0].output_schema.description #=> String
     #   resp.target_configuration.mcp.mcp_server.endpoint #=> String
+    #   resp.target_configuration.mcp.api_gateway.rest_api_id #=> String
+    #   resp.target_configuration.mcp.api_gateway.stage #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].name #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].description #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].path #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].method #=> String, one of "GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "PUT", "POST"
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].filter_path #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].methods #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].methods[0] #=> String, one of "GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "PUT", "POST"
     #   resp.credential_provider_configurations #=> Array
     #   resp.credential_provider_configurations[0].credential_provider_type #=> String, one of "GATEWAY_IAM_ROLE", "OAUTH", "API_KEY"
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.provider_arn #=> String
@@ -1224,6 +1435,8 @@ module Aws::BedrockAgentCoreControl
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.scopes[0] #=> String
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.custom_parameters #=> Hash
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.custom_parameters["OAuthCustomParametersKey"] #=> String
+    #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.grant_type #=> String, one of "CLIENT_CREDENTIALS", "AUTHORIZATION_CODE"
+    #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.default_return_url #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.provider_arn #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.credential_parameter_name #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.credential_prefix #=> String
@@ -1338,6 +1551,21 @@ module Aws::BedrockAgentCoreControl
     #                 model_id: "String", # required
     #               },
     #             },
+    #             episodic_override: {
+    #               extraction: {
+    #                 append_to_prompt: "Prompt", # required
+    #                 model_id: "String", # required
+    #               },
+    #               consolidation: {
+    #                 append_to_prompt: "Prompt", # required
+    #                 model_id: "String", # required
+    #               },
+    #               reflection: {
+    #                 append_to_prompt: "Prompt", # required
+    #                 model_id: "String", # required
+    #                 namespaces: ["Namespace"],
+    #               },
+    #             },
     #             self_managed_configuration: {
     #               trigger_conditions: [
     #                 {
@@ -1360,6 +1588,14 @@ module Aws::BedrockAgentCoreControl
     #             },
     #           },
     #         },
+    #         episodic_memory_strategy: {
+    #           name: "Name", # required
+    #           description: "Description",
+    #           namespaces: ["Namespace"],
+    #           reflection_configuration: {
+    #             namespaces: ["Namespace"], # required
+    #           },
+    #         },
     #       },
     #     ],
     #     tags: {
@@ -1384,17 +1620,27 @@ module Aws::BedrockAgentCoreControl
     #   resp.memory.strategies[0].strategy_id #=> String
     #   resp.memory.strategies[0].name #=> String
     #   resp.memory.strategies[0].description #=> String
-    #   resp.memory.strategies[0].configuration.type #=> String, one of "SEMANTIC_OVERRIDE", "SUMMARY_OVERRIDE", "USER_PREFERENCE_OVERRIDE", "SELF_MANAGED"
+    #   resp.memory.strategies[0].configuration.type #=> String, one of "SEMANTIC_OVERRIDE", "SUMMARY_OVERRIDE", "USER_PREFERENCE_OVERRIDE", "SELF_MANAGED", "EPISODIC_OVERRIDE"
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.semantic_extraction_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.semantic_extraction_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.user_preference_extraction_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.user_preference_extraction_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.episodic_extraction_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.episodic_extraction_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.semantic_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.semantic_consolidation_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.summary_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.summary_consolidation_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.user_preference_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.user_preference_consolidation_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.episodic_consolidation_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.episodic_consolidation_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.namespaces #=> Array
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.namespaces[0] #=> String
+    #   resp.memory.strategies[0].configuration.reflection.episodic_reflection_configuration.namespaces #=> Array
+    #   resp.memory.strategies[0].configuration.reflection.episodic_reflection_configuration.namespaces[0] #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions #=> Array
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions[0].message_based_trigger.message_count #=> Integer
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions[0].token_based_trigger.token_count #=> Integer
@@ -1402,7 +1648,7 @@ module Aws::BedrockAgentCoreControl
     #   resp.memory.strategies[0].configuration.self_managed_configuration.invocation_configuration.topic_arn #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.invocation_configuration.payload_delivery_bucket_name #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.historical_context_window_size #=> Integer
-    #   resp.memory.strategies[0].type #=> String, one of "SEMANTIC", "SUMMARIZATION", "USER_PREFERENCE", "CUSTOM"
+    #   resp.memory.strategies[0].type #=> String, one of "SEMANTIC", "SUMMARIZATION", "USER_PREFERENCE", "CUSTOM", "EPISODIC"
     #   resp.memory.strategies[0].namespaces #=> Array
     #   resp.memory.strategies[0].namespaces[0] #=> String
     #   resp.memory.strategies[0].created_at #=> Time
@@ -1604,6 +1850,315 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Creates an online evaluation configuration for continuous monitoring
+    # of agent performance. Online evaluation automatically samples live
+    # traffic from CloudWatch logs at specified rates and applies evaluators
+    # to assess agent quality in production.
+    #
+    # @option params [String] :client_token
+    #   A unique, case-sensitive identifier to ensure that the API request
+    #   completes no more than one time. If you don't specify this field, a
+    #   value is randomly generated for you. If this token matches a previous
+    #   request, the service ignores the request, but doesn't return an
+    #   error. For more information, see [Ensuring idempotency][1].
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html
+    #
+    # @option params [required, String] :online_evaluation_config_name
+    #   The name of the online evaluation configuration. Must be unique within
+    #   your account.
+    #
+    # @option params [String] :description
+    #   The description of the online evaluation configuration that explains
+    #   its monitoring purpose and scope.
+    #
+    # @option params [required, Types::Rule] :rule
+    #   The evaluation rule that defines sampling configuration, filters, and
+    #   session detection settings for the online evaluation.
+    #
+    # @option params [required, Types::DataSourceConfig] :data_source_config
+    #   The data source configuration that specifies CloudWatch log groups and
+    #   service names to monitor for agent traces.
+    #
+    # @option params [required, Array<Types::EvaluatorReference>] :evaluators
+    #   The list of evaluators to apply during online evaluation. Can include
+    #   both built-in evaluators and custom evaluators created with
+    #   `CreateEvaluator`.
+    #
+    # @option params [required, String] :evaluation_execution_role_arn
+    #   The Amazon Resource Name (ARN) of the IAM role that grants permissions
+    #   to read from CloudWatch logs, write evaluation results, and invoke
+    #   Amazon Bedrock models for evaluation.
+    #
+    # @option params [required, Boolean] :enable_on_create
+    #   Whether to enable the online evaluation configuration immediately upon
+    #   creation. If true, evaluation begins automatically.
+    #
+    # @return [Types::CreateOnlineEvaluationConfigResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CreateOnlineEvaluationConfigResponse#online_evaluation_config_arn #online_evaluation_config_arn} => String
+    #   * {Types::CreateOnlineEvaluationConfigResponse#online_evaluation_config_id #online_evaluation_config_id} => String
+    #   * {Types::CreateOnlineEvaluationConfigResponse#created_at #created_at} => Time
+    #   * {Types::CreateOnlineEvaluationConfigResponse#output_config #output_config} => Types::OutputConfig
+    #   * {Types::CreateOnlineEvaluationConfigResponse#status #status} => String
+    #   * {Types::CreateOnlineEvaluationConfigResponse#execution_status #execution_status} => String
+    #   * {Types::CreateOnlineEvaluationConfigResponse#failure_reason #failure_reason} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.create_online_evaluation_config({
+    #     client_token: "ClientToken",
+    #     online_evaluation_config_name: "EvaluationConfigName", # required
+    #     description: "EvaluationConfigDescription",
+    #     rule: { # required
+    #       sampling_config: { # required
+    #         sampling_percentage: 1.0, # required
+    #       },
+    #       filters: [
+    #         {
+    #           key: "FilterKeyString", # required
+    #           operator: "Equals", # required, accepts Equals, NotEquals, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, Contains, NotContains
+    #           value: { # required
+    #             string_value: "FilterValueStringValueString",
+    #             double_value: 1.0,
+    #             boolean_value: false,
+    #           },
+    #         },
+    #       ],
+    #       session_config: {
+    #         session_timeout_minutes: 1, # required
+    #       },
+    #     },
+    #     data_source_config: { # required
+    #       cloud_watch_logs: {
+    #         log_group_names: ["LogGroupName"], # required
+    #         service_names: ["ServiceName"], # required
+    #       },
+    #     },
+    #     evaluators: [ # required
+    #       {
+    #         evaluator_id: "EvaluatorId",
+    #       },
+    #     ],
+    #     evaluation_execution_role_arn: "RoleArn", # required
+    #     enable_on_create: false, # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.online_evaluation_config_arn #=> String
+    #   resp.online_evaluation_config_id #=> String
+    #   resp.created_at #=> Time
+    #   resp.output_config.cloud_watch_config.log_group_name #=> String
+    #   resp.status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #   resp.execution_status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.failure_reason #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/CreateOnlineEvaluationConfig AWS API Documentation
+    #
+    # @overload create_online_evaluation_config(params = {})
+    # @param [Hash] params ({})
+    def create_online_evaluation_config(params = {}, options = {})
+      req = build_request(:create_online_evaluation_config, params)
+      req.send_request(options)
+    end
+
+    # Creates a policy within the AgentCore Policy system. Policies provide
+    # real-time, deterministic control over agentic interactions with
+    # AgentCore Gateway. Using the Cedar policy language, you can define
+    # fine-grained policies that specify which interactions with Gateway
+    # tools are permitted based on input parameters and OAuth claims,
+    # ensuring agents operate within defined boundaries and business rules.
+    # The policy is validated during creation against the Cedar schema
+    # generated from the Gateway's tools' input schemas, which defines the
+    # available tools, their parameters, and expected data types. This is an
+    # asynchronous operation. Use the [GetPolicy][1] operation to poll the
+    # `status` field to track completion.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/API_GetPolicy.html
+    #
+    # @option params [required, String] :name
+    #   The customer-assigned immutable name for the policy. Must be unique
+    #   within the account. This name is used for policy identification and
+    #   cannot be changed after creation.
+    #
+    # @option params [required, Types::PolicyDefinition] :definition
+    #   The Cedar policy statement that defines the access control rules. This
+    #   contains the actual policy logic written in Cedar policy language,
+    #   specifying effect (permit or forbid), principals, actions, resources,
+    #   and conditions for agent behavior control.
+    #
+    # @option params [String] :description
+    #   A human-readable description of the policy's purpose and
+    #   functionality (1-4,096 characters). This helps policy administrators
+    #   understand the policy's intent, business rules, and operational
+    #   scope. Use this field to document why the policy exists, what business
+    #   requirement it addresses, and any special considerations for
+    #   maintenance. Clear descriptions are essential for policy governance,
+    #   auditing, and troubleshooting.
+    #
+    # @option params [String] :validation_mode
+    #   The validation mode for the policy creation. Determines how Cedar
+    #   analyzer validation results are handled during policy creation.
+    #   FAIL\_ON\_ANY\_FINDINGS (default) runs the Cedar analyzer to validate
+    #   the policy against the Cedar schema and tool context, failing creation
+    #   if the analyzer detects any validation issues to ensure strict
+    #   conformance. IGNORE\_ALL\_FINDINGS runs the Cedar analyzer but allows
+    #   policy creation even if validation issues are detected, useful for
+    #   testing or when the policy schema is evolving. Use
+    #   FAIL\_ON\_ANY\_FINDINGS for production policies to ensure correctness,
+    #   and IGNORE\_ALL\_FINDINGS only when you understand and accept the
+    #   analyzer findings.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The identifier of the policy engine which contains this policy. Policy
+    #   engines group related policies and provide the execution context for
+    #   policy evaluation.
+    #
+    # @option params [String] :client_token
+    #   A unique, case-sensitive identifier to ensure the idempotency of the
+    #   request. The AWS SDK automatically generates this token, so you don't
+    #   need to provide it in most cases. If you retry a request with the same
+    #   client token, the service returns the same response without creating a
+    #   duplicate policy.
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Types::CreatePolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CreatePolicyResponse#policy_id #policy_id} => String
+    #   * {Types::CreatePolicyResponse#name #name} => String
+    #   * {Types::CreatePolicyResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::CreatePolicyResponse#definition #definition} => Types::PolicyDefinition
+    #   * {Types::CreatePolicyResponse#description #description} => String
+    #   * {Types::CreatePolicyResponse#created_at #created_at} => Time
+    #   * {Types::CreatePolicyResponse#updated_at #updated_at} => Time
+    #   * {Types::CreatePolicyResponse#policy_arn #policy_arn} => String
+    #   * {Types::CreatePolicyResponse#status #status} => String
+    #   * {Types::CreatePolicyResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.create_policy({
+    #     name: "PolicyName", # required
+    #     definition: { # required
+    #       cedar: {
+    #         statement: "Statement", # required
+    #       },
+    #     },
+    #     description: "Description",
+    #     validation_mode: "FAIL_ON_ANY_FINDINGS", # accepts FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS
+    #     policy_engine_id: "ResourceId", # required
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_id #=> String
+    #   resp.name #=> String
+    #   resp.policy_engine_id #=> String
+    #   resp.definition.cedar.statement #=> String
+    #   resp.description #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.policy_arn #=> String
+    #   resp.status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/CreatePolicy AWS API Documentation
+    #
+    # @overload create_policy(params = {})
+    # @param [Hash] params ({})
+    def create_policy(params = {}, options = {})
+      req = build_request(:create_policy, params)
+      req.send_request(options)
+    end
+
+    # Creates a new policy engine within the AgentCore Policy system. A
+    # policy engine is a collection of policies that evaluates and
+    # authorizes agent tool calls. When associated with Gateways (each
+    # Gateway can be associated with at most one policy engine, but multiple
+    # Gateways can be associated with the same engine), the policy engine
+    # intercepts all agent requests and determines whether to allow or deny
+    # each action based on the defined policies. This is an asynchronous
+    # operation. Use the [GetPolicyEngine][1] operation to poll the `status`
+    # field to track completion.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/API_GetPolicyEngine.html
+    #
+    # @option params [required, String] :name
+    #   The customer-assigned immutable name for the policy engine. This name
+    #   identifies the policy engine and cannot be changed after creation.
+    #
+    # @option params [String] :description
+    #   A human-readable description of the policy engine's purpose and scope
+    #   (1-4,096 characters). This helps administrators understand the policy
+    #   engine's role in the overall governance strategy. Document which
+    #   Gateway this engine will be associated with, what types of tools or
+    #   workflows it governs, and the team or service responsible for
+    #   maintaining it. Clear descriptions are essential when managing
+    #   multiple policy engines across different services or environments.
+    #
+    # @option params [String] :client_token
+    #   A unique, case-sensitive identifier that you provide to ensure the
+    #   idempotency of the request. If you retry a request with the same
+    #   client token, the service returns the same response without creating a
+    #   duplicate policy engine.
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Types::CreatePolicyEngineResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CreatePolicyEngineResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::CreatePolicyEngineResponse#name #name} => String
+    #   * {Types::CreatePolicyEngineResponse#description #description} => String
+    #   * {Types::CreatePolicyEngineResponse#created_at #created_at} => Time
+    #   * {Types::CreatePolicyEngineResponse#updated_at #updated_at} => Time
+    #   * {Types::CreatePolicyEngineResponse#policy_engine_arn #policy_engine_arn} => String
+    #   * {Types::CreatePolicyEngineResponse#status #status} => String
+    #   * {Types::CreatePolicyEngineResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.create_policy_engine({
+    #     name: "PolicyEngineName", # required
+    #     description: "Description",
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_engine_id #=> String
+    #   resp.name #=> String
+    #   resp.description #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.policy_engine_arn #=> String
+    #   resp.status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/CreatePolicyEngine AWS API Documentation
+    #
+    # @overload create_policy_engine(params = {})
+    # @param [Hash] params ({})
+    def create_policy_engine(params = {}, options = {})
+      req = build_request(:create_policy_engine, params)
+      req.send_request(options)
+    end
+
     # Creates a new workload identity.
     #
     # @option params [required, String] :name
@@ -1837,6 +2392,40 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Deletes a custom evaluator. Builtin evaluators cannot be deleted. The
+    # evaluator must not be referenced by any active online evaluation
+    # configurations.
+    #
+    # @option params [required, String] :evaluator_id
+    #   The unique identifier of the evaluator to delete.
+    #
+    # @return [Types::DeleteEvaluatorResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DeleteEvaluatorResponse#evaluator_arn #evaluator_arn} => String
+    #   * {Types::DeleteEvaluatorResponse#evaluator_id #evaluator_id} => String
+    #   * {Types::DeleteEvaluatorResponse#status #status} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_evaluator({
+    #     evaluator_id: "EvaluatorId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.evaluator_arn #=> String
+    #   resp.evaluator_id #=> String
+    #   resp.status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/DeleteEvaluator AWS API Documentation
+    #
+    # @overload delete_evaluator(params = {})
+    # @param [Hash] params ({})
+    def delete_evaluator(params = {}, options = {})
+      req = build_request(:delete_evaluator, params)
+      req.send_request(options)
+    end
+
     # Deletes a gateway.
     #
     # @option params [required, String] :gateway_identifier
@@ -1970,48 +2559,218 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
-    # Deletes a workload identity.
+    # Deletes an online evaluation configuration and stops any ongoing
+    # evaluation processes associated with it.
     #
-    # @option params [required, String] :name
-    #   The name of the workload identity to delete.
+    # @option params [required, String] :online_evaluation_config_id
+    #   The unique identifier of the online evaluation configuration to
+    #   delete.
     #
-    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    # @return [Types::DeleteOnlineEvaluationConfigResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DeleteOnlineEvaluationConfigResponse#online_evaluation_config_arn #online_evaluation_config_arn} => String
+    #   * {Types::DeleteOnlineEvaluationConfigResponse#online_evaluation_config_id #online_evaluation_config_id} => String
+    #   * {Types::DeleteOnlineEvaluationConfigResponse#status #status} => String
     #
     # @example Request syntax with placeholder values
     #
-    #   resp = client.delete_workload_identity({
-    #     name: "WorkloadIdentityNameType", # required
+    #   resp = client.delete_online_evaluation_config({
+    #     online_evaluation_config_id: "OnlineEvaluationConfigId", # required
     #   })
     #
-    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/DeleteWorkloadIdentity AWS API Documentation
+    # @example Response structure
     #
-    # @overload delete_workload_identity(params = {})
+    #   resp.online_evaluation_config_arn #=> String
+    #   resp.online_evaluation_config_id #=> String
+    #   resp.status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/DeleteOnlineEvaluationConfig AWS API Documentation
+    #
+    # @overload delete_online_evaluation_config(params = {})
     # @param [Hash] params ({})
-    def delete_workload_identity(params = {}, options = {})
-      req = build_request(:delete_workload_identity, params)
+    def delete_online_evaluation_config(params = {}, options = {})
+      req = build_request(:delete_online_evaluation_config, params)
       req.send_request(options)
     end
 
-    # Gets an Amazon Bedrock AgentCore Runtime.
+    # Deletes an existing policy from the AgentCore Policy system. Once
+    # deleted, the policy can no longer be used for agent behavior control
+    # and all references to it become invalid. This is an asynchronous
+    # operation. Use the `GetPolicy` operation to poll the `status` field to
+    # track completion.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The identifier of the policy engine that manages the policy to be
+    #   deleted. This ensures the policy is deleted from the correct policy
+    #   engine context.
+    #
+    # @option params [required, String] :policy_id
+    #   The unique identifier of the policy to be deleted. This must be a
+    #   valid policy ID that exists within the specified policy engine.
+    #
+    # @return [Types::DeletePolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DeletePolicyResponse#policy_id #policy_id} => String
+    #   * {Types::DeletePolicyResponse#name #name} => String
+    #   * {Types::DeletePolicyResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::DeletePolicyResponse#definition #definition} => Types::PolicyDefinition
+    #   * {Types::DeletePolicyResponse#description #description} => String
+    #   * {Types::DeletePolicyResponse#created_at #created_at} => Time
+    #   * {Types::DeletePolicyResponse#updated_at #updated_at} => Time
+    #   * {Types::DeletePolicyResponse#policy_arn #policy_arn} => String
+    #   * {Types::DeletePolicyResponse#status #status} => String
+    #   * {Types::DeletePolicyResponse#status_reasons #status_reasons} => Array&lt;String&gt;
     #
-    # @option params [required, String] :agent_runtime_id
-    #   The unique identifier of the AgentCore Runtime to retrieve.
+    # @example Request syntax with placeholder values
     #
-    # @option params [String] :agent_runtime_version
-    #   The version of the AgentCore Runtime to retrieve.
+    #   resp = client.delete_policy({
+    #     policy_engine_id: "ResourceId", # required
+    #     policy_id: "ResourceId", # required
+    #   })
     #
-    # @return [Types::GetAgentRuntimeResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    # @example Response structure
     #
-    #   * {Types::GetAgentRuntimeResponse#agent_runtime_arn #agent_runtime_arn} => String
-    #   * {Types::GetAgentRuntimeResponse#agent_runtime_name #agent_runtime_name} => String
-    #   * {Types::GetAgentRuntimeResponse#agent_runtime_id #agent_runtime_id} => String
-    #   * {Types::GetAgentRuntimeResponse#agent_runtime_version #agent_runtime_version} => String
-    #   * {Types::GetAgentRuntimeResponse#created_at #created_at} => Time
+    #   resp.policy_id #=> String
+    #   resp.name #=> String
+    #   resp.policy_engine_id #=> String
+    #   resp.definition.cedar.statement #=> String
+    #   resp.description #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.policy_arn #=> String
+    #   resp.status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/DeletePolicy AWS API Documentation
+    #
+    # @overload delete_policy(params = {})
+    # @param [Hash] params ({})
+    def delete_policy(params = {}, options = {})
+      req = build_request(:delete_policy, params)
+      req.send_request(options)
+    end
+
+    # Deletes an existing policy engine from the AgentCore Policy system.
+    # The policy engine must not have any associated policies before
+    # deletion. Once deleted, the policy engine and all its configurations
+    # become unavailable for policy management and evaluation. This is an
+    # asynchronous operation. Use the `GetPolicyEngine` operation to poll
+    # the `status` field to track completion.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The unique identifier of the policy engine to be deleted. This must be
+    #   a valid policy engine ID that exists within the account.
+    #
+    # @return [Types::DeletePolicyEngineResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DeletePolicyEngineResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::DeletePolicyEngineResponse#name #name} => String
+    #   * {Types::DeletePolicyEngineResponse#description #description} => String
+    #   * {Types::DeletePolicyEngineResponse#created_at #created_at} => Time
+    #   * {Types::DeletePolicyEngineResponse#updated_at #updated_at} => Time
+    #   * {Types::DeletePolicyEngineResponse#policy_engine_arn #policy_engine_arn} => String
+    #   * {Types::DeletePolicyEngineResponse#status #status} => String
+    #   * {Types::DeletePolicyEngineResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_policy_engine({
+    #     policy_engine_id: "ResourceId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_engine_id #=> String
+    #   resp.name #=> String
+    #   resp.description #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.policy_engine_arn #=> String
+    #   resp.status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/DeletePolicyEngine AWS API Documentation
+    #
+    # @overload delete_policy_engine(params = {})
+    # @param [Hash] params ({})
+    def delete_policy_engine(params = {}, options = {})
+      req = build_request(:delete_policy_engine, params)
+      req.send_request(options)
+    end
+
+    # Deletes the resource-based policy for a specified resource.
+    #
+    # <note markdown="1"> This feature is currently available only for AgentCore Runtime and
+    # Gateway.
+    #
+    #  </note>
+    #
+    # @option params [required, String] :resource_arn
+    #   The Amazon Resource Name (ARN) of the resource for which to delete the
+    #   resource policy.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_resource_policy({
+    #     resource_arn: "BedrockAgentcoreResourceArn", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/DeleteResourcePolicy AWS API Documentation
+    #
+    # @overload delete_resource_policy(params = {})
+    # @param [Hash] params ({})
+    def delete_resource_policy(params = {}, options = {})
+      req = build_request(:delete_resource_policy, params)
+      req.send_request(options)
+    end
+
+    # Deletes a workload identity.
+    #
+    # @option params [required, String] :name
+    #   The name of the workload identity to delete.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.delete_workload_identity({
+    #     name: "WorkloadIdentityNameType", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/DeleteWorkloadIdentity AWS API Documentation
+    #
+    # @overload delete_workload_identity(params = {})
+    # @param [Hash] params ({})
+    def delete_workload_identity(params = {}, options = {})
+      req = build_request(:delete_workload_identity, params)
+      req.send_request(options)
+    end
+
+    # Gets an Amazon Bedrock AgentCore Runtime.
+    #
+    # @option params [required, String] :agent_runtime_id
+    #   The unique identifier of the AgentCore Runtime to retrieve.
+    #
+    # @option params [String] :agent_runtime_version
+    #   The version of the AgentCore Runtime to retrieve.
+    #
+    # @return [Types::GetAgentRuntimeResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetAgentRuntimeResponse#agent_runtime_arn #agent_runtime_arn} => String
+    #   * {Types::GetAgentRuntimeResponse#agent_runtime_name #agent_runtime_name} => String
+    #   * {Types::GetAgentRuntimeResponse#agent_runtime_id #agent_runtime_id} => String
+    #   * {Types::GetAgentRuntimeResponse#agent_runtime_version #agent_runtime_version} => String
+    #   * {Types::GetAgentRuntimeResponse#created_at #created_at} => Time
     #   * {Types::GetAgentRuntimeResponse#last_updated_at #last_updated_at} => Time
     #   * {Types::GetAgentRuntimeResponse#role_arn #role_arn} => String
     #   * {Types::GetAgentRuntimeResponse#network_configuration #network_configuration} => Types::NetworkConfiguration
     #   * {Types::GetAgentRuntimeResponse#status #status} => String
     #   * {Types::GetAgentRuntimeResponse#lifecycle_configuration #lifecycle_configuration} => Types::LifecycleConfiguration
+    #   * {Types::GetAgentRuntimeResponse#failure_reason #failure_reason} => String
     #   * {Types::GetAgentRuntimeResponse#description #description} => String
     #   * {Types::GetAgentRuntimeResponse#workload_identity_details #workload_identity_details} => Types::WorkloadIdentityDetails
     #   * {Types::GetAgentRuntimeResponse#agent_runtime_artifact #agent_runtime_artifact} => Types::AgentRuntimeArtifact
@@ -2044,6 +2803,7 @@ module Aws::BedrockAgentCoreControl
     #   resp.status #=> String, one of "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "READY", "DELETING"
     #   resp.lifecycle_configuration.idle_runtime_session_timeout #=> Integer
     #   resp.lifecycle_configuration.max_lifetime #=> Integer
+    #   resp.failure_reason #=> String
     #   resp.description #=> String
     #   resp.workload_identity_details.workload_identity_arn #=> String
     #   resp.agent_runtime_artifact.container_configuration.container_uri #=> String
@@ -2061,6 +2821,15 @@ module Aws::BedrockAgentCoreControl
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_audience[0] #=> String
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_clients #=> Array
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_clients[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_scopes #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_scopes[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].inbound_token_claim_name #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].inbound_token_claim_value_type #=> String, one of "STRING", "STRING_ARRAY"
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string_list #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string_list[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_operator #=> String, one of "EQUALS", "CONTAINS", "CONTAINS_ANY"
     #   resp.request_header_configuration.request_header_allowlist #=> Array
     #   resp.request_header_configuration.request_header_allowlist[0] #=> String
     #
@@ -2269,6 +3038,68 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Retrieves detailed information about an evaluator, including its
+    # configuration, status, and metadata. Works with both built-in and
+    # custom evaluators.
+    #
+    # @option params [required, String] :evaluator_id
+    #   The unique identifier of the evaluator to retrieve. Can be a built-in
+    #   evaluator ID (e.g., Builtin.Helpfulness) or a custom evaluator ID.
+    #
+    # @return [Types::GetEvaluatorResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetEvaluatorResponse#evaluator_arn #evaluator_arn} => String
+    #   * {Types::GetEvaluatorResponse#evaluator_id #evaluator_id} => String
+    #   * {Types::GetEvaluatorResponse#evaluator_name #evaluator_name} => String
+    #   * {Types::GetEvaluatorResponse#description #description} => String
+    #   * {Types::GetEvaluatorResponse#evaluator_config #evaluator_config} => Types::EvaluatorConfig
+    #   * {Types::GetEvaluatorResponse#level #level} => String
+    #   * {Types::GetEvaluatorResponse#status #status} => String
+    #   * {Types::GetEvaluatorResponse#created_at #created_at} => Time
+    #   * {Types::GetEvaluatorResponse#updated_at #updated_at} => Time
+    #   * {Types::GetEvaluatorResponse#locked_for_modification #locked_for_modification} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_evaluator({
+    #     evaluator_id: "EvaluatorId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.evaluator_arn #=> String
+    #   resp.evaluator_id #=> String
+    #   resp.evaluator_name #=> String
+    #   resp.description #=> String
+    #   resp.evaluator_config.llm_as_a_judge.instructions #=> String
+    #   resp.evaluator_config.llm_as_a_judge.rating_scale.numerical #=> Array
+    #   resp.evaluator_config.llm_as_a_judge.rating_scale.numerical[0].definition #=> String
+    #   resp.evaluator_config.llm_as_a_judge.rating_scale.numerical[0].value #=> Float
+    #   resp.evaluator_config.llm_as_a_judge.rating_scale.numerical[0].label #=> String
+    #   resp.evaluator_config.llm_as_a_judge.rating_scale.categorical #=> Array
+    #   resp.evaluator_config.llm_as_a_judge.rating_scale.categorical[0].definition #=> String
+    #   resp.evaluator_config.llm_as_a_judge.rating_scale.categorical[0].label #=> String
+    #   resp.evaluator_config.llm_as_a_judge.model_config.bedrock_evaluator_model_config.model_id #=> String
+    #   resp.evaluator_config.llm_as_a_judge.model_config.bedrock_evaluator_model_config.inference_config.max_tokens #=> Integer
+    #   resp.evaluator_config.llm_as_a_judge.model_config.bedrock_evaluator_model_config.inference_config.temperature #=> Float
+    #   resp.evaluator_config.llm_as_a_judge.model_config.bedrock_evaluator_model_config.inference_config.top_p #=> Float
+    #   resp.evaluator_config.llm_as_a_judge.model_config.bedrock_evaluator_model_config.inference_config.stop_sequences #=> Array
+    #   resp.evaluator_config.llm_as_a_judge.model_config.bedrock_evaluator_model_config.inference_config.stop_sequences[0] #=> String
+    #   resp.level #=> String, one of "TOOL_CALL", "TRACE", "SESSION"
+    #   resp.status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.locked_for_modification #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/GetEvaluator AWS API Documentation
+    #
+    # @overload get_evaluator(params = {})
+    # @param [Hash] params ({})
+    def get_evaluator(params = {}, options = {})
+      req = build_request(:get_evaluator, params)
+      req.send_request(options)
+    end
+
     # Retrieves information about a specific Gateway.
     #
     # @option params [required, String] :gateway_identifier
@@ -2291,6 +3122,8 @@ module Aws::BedrockAgentCoreControl
     #   * {Types::GetGatewayResponse#authorizer_type #authorizer_type} => String
     #   * {Types::GetGatewayResponse#authorizer_configuration #authorizer_configuration} => Types::AuthorizerConfiguration
     #   * {Types::GetGatewayResponse#kms_key_arn #kms_key_arn} => String
+    #   * {Types::GetGatewayResponse#interceptor_configurations #interceptor_configurations} => Array&lt;Types::GatewayInterceptorConfiguration&gt;
+    #   * {Types::GetGatewayResponse#policy_engine_configuration #policy_engine_configuration} => Types::GatewayPolicyEngineConfiguration
     #   * {Types::GetGatewayResponse#workload_identity_details #workload_identity_details} => Types::WorkloadIdentityDetails
     #   * {Types::GetGatewayResponse#exception_level #exception_level} => String
     #
@@ -2318,13 +3151,29 @@ module Aws::BedrockAgentCoreControl
     #   resp.protocol_configuration.mcp.supported_versions[0] #=> String
     #   resp.protocol_configuration.mcp.instructions #=> String
     #   resp.protocol_configuration.mcp.search_type #=> String, one of "SEMANTIC"
-    #   resp.authorizer_type #=> String, one of "CUSTOM_JWT", "AWS_IAM"
+    #   resp.authorizer_type #=> String, one of "CUSTOM_JWT", "AWS_IAM", "NONE"
     #   resp.authorizer_configuration.custom_jwt_authorizer.discovery_url #=> String
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_audience #=> Array
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_audience[0] #=> String
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_clients #=> Array
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_clients[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_scopes #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_scopes[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].inbound_token_claim_name #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].inbound_token_claim_value_type #=> String, one of "STRING", "STRING_ARRAY"
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string_list #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string_list[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_operator #=> String, one of "EQUALS", "CONTAINS", "CONTAINS_ANY"
     #   resp.kms_key_arn #=> String
+    #   resp.interceptor_configurations #=> Array
+    #   resp.interceptor_configurations[0].interceptor.lambda.arn #=> String
+    #   resp.interceptor_configurations[0].interception_points #=> Array
+    #   resp.interceptor_configurations[0].interception_points[0] #=> String, one of "REQUEST", "RESPONSE"
+    #   resp.interceptor_configurations[0].input_configuration.pass_request_headers #=> Boolean
+    #   resp.policy_engine_configuration.arn #=> String
+    #   resp.policy_engine_configuration.mode #=> String, one of "LOG_ONLY", "ENFORCE"
     #   resp.workload_identity_details.workload_identity_arn #=> String
     #   resp.exception_level #=> String, one of "DEBUG"
     #
@@ -2404,6 +3253,17 @@ module Aws::BedrockAgentCoreControl
     #   resp.target_configuration.mcp.lambda.tool_schema.inline_payload[0].output_schema.items #=> Types::SchemaDefinition
     #   resp.target_configuration.mcp.lambda.tool_schema.inline_payload[0].output_schema.description #=> String
     #   resp.target_configuration.mcp.mcp_server.endpoint #=> String
+    #   resp.target_configuration.mcp.api_gateway.rest_api_id #=> String
+    #   resp.target_configuration.mcp.api_gateway.stage #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].name #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].description #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].path #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].method #=> String, one of "GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "PUT", "POST"
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].filter_path #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].methods #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].methods[0] #=> String, one of "GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "PUT", "POST"
     #   resp.credential_provider_configurations #=> Array
     #   resp.credential_provider_configurations[0].credential_provider_type #=> String, one of "GATEWAY_IAM_ROLE", "OAUTH", "API_KEY"
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.provider_arn #=> String
@@ -2411,6 +3271,8 @@ module Aws::BedrockAgentCoreControl
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.scopes[0] #=> String
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.custom_parameters #=> Hash
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.custom_parameters["OAuthCustomParametersKey"] #=> String
+    #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.grant_type #=> String, one of "CLIENT_CREDENTIALS", "AUTHORIZATION_CODE"
+    #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.default_return_url #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.provider_arn #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.credential_parameter_name #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.credential_prefix #=> String
@@ -2458,17 +3320,27 @@ module Aws::BedrockAgentCoreControl
     #   resp.memory.strategies[0].strategy_id #=> String
     #   resp.memory.strategies[0].name #=> String
     #   resp.memory.strategies[0].description #=> String
-    #   resp.memory.strategies[0].configuration.type #=> String, one of "SEMANTIC_OVERRIDE", "SUMMARY_OVERRIDE", "USER_PREFERENCE_OVERRIDE", "SELF_MANAGED"
+    #   resp.memory.strategies[0].configuration.type #=> String, one of "SEMANTIC_OVERRIDE", "SUMMARY_OVERRIDE", "USER_PREFERENCE_OVERRIDE", "SELF_MANAGED", "EPISODIC_OVERRIDE"
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.semantic_extraction_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.semantic_extraction_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.user_preference_extraction_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.user_preference_extraction_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.episodic_extraction_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.episodic_extraction_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.semantic_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.semantic_consolidation_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.summary_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.summary_consolidation_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.user_preference_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.user_preference_consolidation_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.episodic_consolidation_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.episodic_consolidation_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.namespaces #=> Array
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.namespaces[0] #=> String
+    #   resp.memory.strategies[0].configuration.reflection.episodic_reflection_configuration.namespaces #=> Array
+    #   resp.memory.strategies[0].configuration.reflection.episodic_reflection_configuration.namespaces[0] #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions #=> Array
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions[0].message_based_trigger.message_count #=> Integer
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions[0].token_based_trigger.token_count #=> Integer
@@ -2476,7 +3348,7 @@ module Aws::BedrockAgentCoreControl
     #   resp.memory.strategies[0].configuration.self_managed_configuration.invocation_configuration.topic_arn #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.invocation_configuration.payload_delivery_bucket_name #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.historical_context_window_size #=> Integer
-    #   resp.memory.strategies[0].type #=> String, one of "SEMANTIC", "SUMMARIZATION", "USER_PREFERENCE", "CUSTOM"
+    #   resp.memory.strategies[0].type #=> String, one of "SEMANTIC", "SUMMARIZATION", "USER_PREFERENCE", "CUSTOM", "EPISODIC"
     #   resp.memory.strategies[0].namespaces #=> Array
     #   resp.memory.strategies[0].namespaces[0] #=> String
     #   resp.memory.strategies[0].created_at #=> Time
@@ -2619,6 +3491,290 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Retrieves detailed information about an online evaluation
+    # configuration, including its rules, data sources, evaluators, and
+    # execution status.
+    #
+    # @option params [required, String] :online_evaluation_config_id
+    #   The unique identifier of the online evaluation configuration to
+    #   retrieve.
+    #
+    # @return [Types::GetOnlineEvaluationConfigResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetOnlineEvaluationConfigResponse#online_evaluation_config_arn #online_evaluation_config_arn} => String
+    #   * {Types::GetOnlineEvaluationConfigResponse#online_evaluation_config_id #online_evaluation_config_id} => String
+    #   * {Types::GetOnlineEvaluationConfigResponse#online_evaluation_config_name #online_evaluation_config_name} => String
+    #   * {Types::GetOnlineEvaluationConfigResponse#description #description} => String
+    #   * {Types::GetOnlineEvaluationConfigResponse#rule #rule} => Types::Rule
+    #   * {Types::GetOnlineEvaluationConfigResponse#data_source_config #data_source_config} => Types::DataSourceConfig
+    #   * {Types::GetOnlineEvaluationConfigResponse#evaluators #evaluators} => Array&lt;Types::EvaluatorReference&gt;
+    #   * {Types::GetOnlineEvaluationConfigResponse#output_config #output_config} => Types::OutputConfig
+    #   * {Types::GetOnlineEvaluationConfigResponse#evaluation_execution_role_arn #evaluation_execution_role_arn} => String
+    #   * {Types::GetOnlineEvaluationConfigResponse#status #status} => String
+    #   * {Types::GetOnlineEvaluationConfigResponse#execution_status #execution_status} => String
+    #   * {Types::GetOnlineEvaluationConfigResponse#created_at #created_at} => Time
+    #   * {Types::GetOnlineEvaluationConfigResponse#updated_at #updated_at} => Time
+    #   * {Types::GetOnlineEvaluationConfigResponse#failure_reason #failure_reason} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_online_evaluation_config({
+    #     online_evaluation_config_id: "OnlineEvaluationConfigId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.online_evaluation_config_arn #=> String
+    #   resp.online_evaluation_config_id #=> String
+    #   resp.online_evaluation_config_name #=> String
+    #   resp.description #=> String
+    #   resp.rule.sampling_config.sampling_percentage #=> Float
+    #   resp.rule.filters #=> Array
+    #   resp.rule.filters[0].key #=> String
+    #   resp.rule.filters[0].operator #=> String, one of "Equals", "NotEquals", "GreaterThan", "LessThan", "GreaterThanOrEqual", "LessThanOrEqual", "Contains", "NotContains"
+    #   resp.rule.filters[0].value.string_value #=> String
+    #   resp.rule.filters[0].value.double_value #=> Float
+    #   resp.rule.filters[0].value.boolean_value #=> Boolean
+    #   resp.rule.session_config.session_timeout_minutes #=> Integer
+    #   resp.data_source_config.cloud_watch_logs.log_group_names #=> Array
+    #   resp.data_source_config.cloud_watch_logs.log_group_names[0] #=> String
+    #   resp.data_source_config.cloud_watch_logs.service_names #=> Array
+    #   resp.data_source_config.cloud_watch_logs.service_names[0] #=> String
+    #   resp.evaluators #=> Array
+    #   resp.evaluators[0].evaluator_id #=> String
+    #   resp.output_config.cloud_watch_config.log_group_name #=> String
+    #   resp.evaluation_execution_role_arn #=> String
+    #   resp.status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #   resp.execution_status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.failure_reason #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/GetOnlineEvaluationConfig AWS API Documentation
+    #
+    # @overload get_online_evaluation_config(params = {})
+    # @param [Hash] params ({})
+    def get_online_evaluation_config(params = {}, options = {})
+      req = build_request(:get_online_evaluation_config, params)
+      req.send_request(options)
+    end
+
+    # Retrieves detailed information about a specific policy within the
+    # AgentCore Policy system. This operation returns the complete policy
+    # definition, metadata, and current status, allowing administrators to
+    # review and manage policy configurations.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The identifier of the policy engine that manages the policy to be
+    #   retrieved.
+    #
+    # @option params [required, String] :policy_id
+    #   The unique identifier of the policy to be retrieved. This must be a
+    #   valid policy ID that exists within the specified policy engine.
+    #
+    # @return [Types::GetPolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetPolicyResponse#policy_id #policy_id} => String
+    #   * {Types::GetPolicyResponse#name #name} => String
+    #   * {Types::GetPolicyResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::GetPolicyResponse#definition #definition} => Types::PolicyDefinition
+    #   * {Types::GetPolicyResponse#description #description} => String
+    #   * {Types::GetPolicyResponse#created_at #created_at} => Time
+    #   * {Types::GetPolicyResponse#updated_at #updated_at} => Time
+    #   * {Types::GetPolicyResponse#policy_arn #policy_arn} => String
+    #   * {Types::GetPolicyResponse#status #status} => String
+    #   * {Types::GetPolicyResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_policy({
+    #     policy_engine_id: "ResourceId", # required
+    #     policy_id: "ResourceId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_id #=> String
+    #   resp.name #=> String
+    #   resp.policy_engine_id #=> String
+    #   resp.definition.cedar.statement #=> String
+    #   resp.description #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.policy_arn #=> String
+    #   resp.status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #
+    #
+    # The following waiters are defined for this operation (see {Client#wait_until} for detailed usage):
+    #
+    #   * policy_active
+    #   * policy_deleted
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/GetPolicy AWS API Documentation
+    #
+    # @overload get_policy(params = {})
+    # @param [Hash] params ({})
+    def get_policy(params = {}, options = {})
+      req = build_request(:get_policy, params)
+      req.send_request(options)
+    end
+
+    # Retrieves detailed information about a specific policy engine within
+    # the AgentCore Policy system. This operation returns the complete
+    # policy engine configuration, metadata, and current status, allowing
+    # administrators to review and manage policy engine settings.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The unique identifier of the policy engine to be retrieved. This must
+    #   be a valid policy engine ID that exists within the account.
+    #
+    # @return [Types::GetPolicyEngineResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetPolicyEngineResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::GetPolicyEngineResponse#name #name} => String
+    #   * {Types::GetPolicyEngineResponse#description #description} => String
+    #   * {Types::GetPolicyEngineResponse#created_at #created_at} => Time
+    #   * {Types::GetPolicyEngineResponse#updated_at #updated_at} => Time
+    #   * {Types::GetPolicyEngineResponse#policy_engine_arn #policy_engine_arn} => String
+    #   * {Types::GetPolicyEngineResponse#status #status} => String
+    #   * {Types::GetPolicyEngineResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_policy_engine({
+    #     policy_engine_id: "ResourceId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_engine_id #=> String
+    #   resp.name #=> String
+    #   resp.description #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.policy_engine_arn #=> String
+    #   resp.status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #
+    #
+    # The following waiters are defined for this operation (see {Client#wait_until} for detailed usage):
+    #
+    #   * policy_engine_active
+    #   * policy_engine_deleted
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/GetPolicyEngine AWS API Documentation
+    #
+    # @overload get_policy_engine(params = {})
+    # @param [Hash] params ({})
+    def get_policy_engine(params = {}, options = {})
+      req = build_request(:get_policy_engine, params)
+      req.send_request(options)
+    end
+
+    # Retrieves information about a policy generation request within the
+    # AgentCore Policy system. Policy generation converts natural language
+    # descriptions into Cedar policy statements using AI-powered
+    # translation, enabling non-technical users to create policies.
+    #
+    # @option params [required, String] :policy_generation_id
+    #   The unique identifier of the policy generation request to be
+    #   retrieved. This must be a valid generation ID from a previous
+    #   [StartPolicyGeneration][1] call.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/API_StartPolicyGeneration.html
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The identifier of the policy engine associated with the policy
+    #   generation request. This provides the context for the generation
+    #   operation and schema validation.
+    #
+    # @return [Types::GetPolicyGenerationResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetPolicyGenerationResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::GetPolicyGenerationResponse#policy_generation_id #policy_generation_id} => String
+    #   * {Types::GetPolicyGenerationResponse#name #name} => String
+    #   * {Types::GetPolicyGenerationResponse#policy_generation_arn #policy_generation_arn} => String
+    #   * {Types::GetPolicyGenerationResponse#resource #resource} => Types::Resource
+    #   * {Types::GetPolicyGenerationResponse#created_at #created_at} => Time
+    #   * {Types::GetPolicyGenerationResponse#updated_at #updated_at} => Time
+    #   * {Types::GetPolicyGenerationResponse#status #status} => String
+    #   * {Types::GetPolicyGenerationResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #   * {Types::GetPolicyGenerationResponse#findings #findings} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_policy_generation({
+    #     policy_generation_id: "ResourceId", # required
+    #     policy_engine_id: "ResourceId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_engine_id #=> String
+    #   resp.policy_generation_id #=> String
+    #   resp.name #=> String
+    #   resp.policy_generation_arn #=> String
+    #   resp.resource.arn #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.status #=> String, one of "GENERATING", "GENERATED", "GENERATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #   resp.findings #=> String
+    #
+    #
+    # The following waiters are defined for this operation (see {Client#wait_until} for detailed usage):
+    #
+    #   * policy_generation_completed
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/GetPolicyGeneration AWS API Documentation
+    #
+    # @overload get_policy_generation(params = {})
+    # @param [Hash] params ({})
+    def get_policy_generation(params = {}, options = {})
+      req = build_request(:get_policy_generation, params)
+      req.send_request(options)
+    end
+
+    # Retrieves the resource-based policy for a specified resource.
+    #
+    # <note markdown="1"> This feature is currently available only for AgentCore Runtime and
+    # Gateway.
+    #
+    #  </note>
+    #
+    # @option params [required, String] :resource_arn
+    #   The Amazon Resource Name (ARN) of the resource for which to retrieve
+    #   the resource policy.
+    #
+    # @return [Types::GetResourcePolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetResourcePolicyResponse#policy #policy} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_resource_policy({
+    #     resource_arn: "BedrockAgentcoreResourceArn", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/GetResourcePolicy AWS API Documentation
+    #
+    # @overload get_resource_policy(params = {})
+    # @param [Hash] params ({})
+    def get_resource_policy(params = {}, options = {})
+      req = build_request(:get_resource_policy, params)
+      req.send_request(options)
+    end
+
     # Retrieves information about a token vault.
     #
     # @option params [String] :token_vault_id
@@ -2967,6 +4123,54 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Lists all available evaluators, including both builtin evaluators
+    # provided by the service and custom evaluators created by the user.
+    #
+    # @option params [String] :next_token
+    #   The pagination token from a previous request to retrieve the next page
+    #   of results.
+    #
+    # @option params [Integer] :max_results
+    #   The maximum number of evaluators to return in a single response.
+    #
+    # @return [Types::ListEvaluatorsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListEvaluatorsResponse#evaluators #evaluators} => Array&lt;Types::EvaluatorSummary&gt;
+    #   * {Types::ListEvaluatorsResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_evaluators({
+    #     next_token: "String",
+    #     max_results: 1,
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.evaluators #=> Array
+    #   resp.evaluators[0].evaluator_arn #=> String
+    #   resp.evaluators[0].evaluator_id #=> String
+    #   resp.evaluators[0].evaluator_name #=> String
+    #   resp.evaluators[0].description #=> String
+    #   resp.evaluators[0].evaluator_type #=> String, one of "Builtin", "Custom"
+    #   resp.evaluators[0].level #=> String, one of "TOOL_CALL", "TRACE", "SESSION"
+    #   resp.evaluators[0].status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #   resp.evaluators[0].created_at #=> Time
+    #   resp.evaluators[0].updated_at #=> Time
+    #   resp.evaluators[0].locked_for_modification #=> Boolean
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ListEvaluators AWS API Documentation
+    #
+    # @overload list_evaluators(params = {})
+    # @param [Hash] params ({})
+    def list_evaluators(params = {}, options = {})
+      req = build_request(:list_evaluators, params)
+      req.send_request(options)
+    end
+
     # Lists all targets for a specific gateway.
     #
     # @option params [required, String] :gateway_identifier
@@ -3056,7 +4260,7 @@ module Aws::BedrockAgentCoreControl
     #   resp.items[0].description #=> String
     #   resp.items[0].created_at #=> Time
     #   resp.items[0].updated_at #=> Time
-    #   resp.items[0].authorizer_type #=> String, one of "CUSTOM_JWT", "AWS_IAM"
+    #   resp.items[0].authorizer_type #=> String, one of "CUSTOM_JWT", "AWS_IAM", "NONE"
     #   resp.items[0].protocol_type #=> String, one of "MCP"
     #   resp.next_token #=> String
     #
@@ -3146,12 +4350,315 @@ module Aws::BedrockAgentCoreControl
     #   resp.credential_providers[0].last_updated_time #=> Time
     #   resp.next_token #=> String
     #
-    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ListOauth2CredentialProviders AWS API Documentation
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ListOauth2CredentialProviders AWS API Documentation
+    #
+    # @overload list_oauth_2_credential_providers(params = {})
+    # @param [Hash] params ({})
+    def list_oauth_2_credential_providers(params = {}, options = {})
+      req = build_request(:list_oauth_2_credential_providers, params)
+      req.send_request(options)
+    end
+
+    # Lists all online evaluation configurations in the account, providing
+    # summary information about each configuration's status and settings.
+    #
+    # @option params [String] :next_token
+    #   The pagination token from a previous request to retrieve the next page
+    #   of results.
+    #
+    # @option params [Integer] :max_results
+    #   The maximum number of online evaluation configurations to return in a
+    #   single response.
+    #
+    # @return [Types::ListOnlineEvaluationConfigsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListOnlineEvaluationConfigsResponse#online_evaluation_configs #online_evaluation_configs} => Array&lt;Types::OnlineEvaluationConfigSummary&gt;
+    #   * {Types::ListOnlineEvaluationConfigsResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_online_evaluation_configs({
+    #     next_token: "String",
+    #     max_results: 1,
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.online_evaluation_configs #=> Array
+    #   resp.online_evaluation_configs[0].online_evaluation_config_arn #=> String
+    #   resp.online_evaluation_configs[0].online_evaluation_config_id #=> String
+    #   resp.online_evaluation_configs[0].online_evaluation_config_name #=> String
+    #   resp.online_evaluation_configs[0].description #=> String
+    #   resp.online_evaluation_configs[0].status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #   resp.online_evaluation_configs[0].execution_status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.online_evaluation_configs[0].created_at #=> Time
+    #   resp.online_evaluation_configs[0].updated_at #=> Time
+    #   resp.online_evaluation_configs[0].failure_reason #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ListOnlineEvaluationConfigs AWS API Documentation
+    #
+    # @overload list_online_evaluation_configs(params = {})
+    # @param [Hash] params ({})
+    def list_online_evaluation_configs(params = {}, options = {})
+      req = build_request(:list_online_evaluation_configs, params)
+      req.send_request(options)
+    end
+
+    # Retrieves a list of policies within the AgentCore Policy engine. This
+    # operation supports pagination and filtering to help administrators
+    # manage and discover policies across policy engines. Results can be
+    # filtered by policy engine or resource associations.
+    #
+    # @option params [String] :next_token
+    #   A pagination token returned from a previous [ListPolicies][1] call.
+    #   Use this token to retrieve the next page of results when the response
+    #   is paginated.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/API_ListPolicies.html
+    #
+    # @option params [Integer] :max_results
+    #   The maximum number of policies to return in a single response. If not
+    #   specified, the default is 10 policies per page, with a maximum of 100
+    #   per page.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The identifier of the policy engine whose policies to retrieve.
+    #
+    # @option params [String] :target_resource_scope
+    #   Optional filter to list policies that apply to a specific resource
+    #   scope or resource type. This helps narrow down policy results to those
+    #   relevant for particular Amazon Web Services resources, agent tools, or
+    #   operational contexts within the policy engine ecosystem.
+    #
+    # @return [Types::ListPoliciesResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListPoliciesResponse#policies #policies} => Array&lt;Types::Policy&gt;
+    #   * {Types::ListPoliciesResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_policies({
+    #     next_token: "NextToken",
+    #     max_results: 1,
+    #     policy_engine_id: "ResourceId", # required
+    #     target_resource_scope: "BedrockAgentcoreResourceArn",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policies #=> Array
+    #   resp.policies[0].policy_id #=> String
+    #   resp.policies[0].name #=> String
+    #   resp.policies[0].policy_engine_id #=> String
+    #   resp.policies[0].definition.cedar.statement #=> String
+    #   resp.policies[0].description #=> String
+    #   resp.policies[0].created_at #=> Time
+    #   resp.policies[0].updated_at #=> Time
+    #   resp.policies[0].policy_arn #=> String
+    #   resp.policies[0].status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.policies[0].status_reasons #=> Array
+    #   resp.policies[0].status_reasons[0] #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ListPolicies AWS API Documentation
+    #
+    # @overload list_policies(params = {})
+    # @param [Hash] params ({})
+    def list_policies(params = {}, options = {})
+      req = build_request(:list_policies, params)
+      req.send_request(options)
+    end
+
+    # Retrieves a list of policy engines within the AgentCore Policy system.
+    # This operation supports pagination to help administrators discover and
+    # manage policy engines across their account. Each policy engine serves
+    # as a container for related policies.
+    #
+    # @option params [String] :next_token
+    #   A pagination token returned from a previous [ListPolicyEngines][1]
+    #   call. Use this token to retrieve the next page of results when the
+    #   response is paginated.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/API_ListPolicyEngines.html
+    #
+    # @option params [Integer] :max_results
+    #   The maximum number of policy engines to return in a single response.
+    #   If not specified, the default is 10 policy engines per page, with a
+    #   maximum of 100 per page.
+    #
+    # @return [Types::ListPolicyEnginesResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListPolicyEnginesResponse#policy_engines #policy_engines} => Array&lt;Types::PolicyEngine&gt;
+    #   * {Types::ListPolicyEnginesResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_policy_engines({
+    #     next_token: "NextToken",
+    #     max_results: 1,
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_engines #=> Array
+    #   resp.policy_engines[0].policy_engine_id #=> String
+    #   resp.policy_engines[0].name #=> String
+    #   resp.policy_engines[0].description #=> String
+    #   resp.policy_engines[0].created_at #=> Time
+    #   resp.policy_engines[0].updated_at #=> Time
+    #   resp.policy_engines[0].policy_engine_arn #=> String
+    #   resp.policy_engines[0].status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.policy_engines[0].status_reasons #=> Array
+    #   resp.policy_engines[0].status_reasons[0] #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ListPolicyEngines AWS API Documentation
+    #
+    # @overload list_policy_engines(params = {})
+    # @param [Hash] params ({})
+    def list_policy_engines(params = {}, options = {})
+      req = build_request(:list_policy_engines, params)
+      req.send_request(options)
+    end
+
+    # Retrieves a list of generated policy assets from a policy generation
+    # request within the AgentCore Policy system. This operation returns the
+    # actual Cedar policies and related artifacts produced by the AI-powered
+    # policy generation process, allowing users to review and select from
+    # multiple generated policy options.
+    #
+    # @option params [required, String] :policy_generation_id
+    #   The unique identifier of the policy generation request whose assets
+    #   are to be retrieved. This must be a valid generation ID from a
+    #   previous [StartPolicyGeneration][1] call that has completed
+    #   processing.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/API_StartPolicyGeneration.html
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The unique identifier of the policy engine associated with the policy
+    #   generation request. This provides the context for the generation
+    #   operation and ensures assets are retrieved from the correct policy
+    #   engine.
+    #
+    # @option params [String] :next_token
+    #   A pagination token returned from a previous
+    #   [ListPolicyGenerationAssets][1] call. Use this token to retrieve the
+    #   next page of assets when the response is paginated due to large
+    #   numbers of generated policy options.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/API_ListPolicyGenerationAssets.html
+    #
+    # @option params [Integer] :max_results
+    #   The maximum number of policy generation assets to return in a single
+    #   response. If not specified, the default is 10 assets per page, with a
+    #   maximum of 100 per page. This helps control response size when dealing
+    #   with policy generations that produce many alternative policy options.
+    #
+    # @return [Types::ListPolicyGenerationAssetsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListPolicyGenerationAssetsResponse#policy_generation_assets #policy_generation_assets} => Array&lt;Types::PolicyGenerationAsset&gt;
+    #   * {Types::ListPolicyGenerationAssetsResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_policy_generation_assets({
+    #     policy_generation_id: "ResourceId", # required
+    #     policy_engine_id: "ResourceId", # required
+    #     next_token: "NextToken",
+    #     max_results: 1,
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_generation_assets #=> Array
+    #   resp.policy_generation_assets[0].policy_generation_asset_id #=> String
+    #   resp.policy_generation_assets[0].definition.cedar.statement #=> String
+    #   resp.policy_generation_assets[0].raw_text_fragment #=> String
+    #   resp.policy_generation_assets[0].findings #=> Array
+    #   resp.policy_generation_assets[0].findings[0].type #=> String, one of "VALID", "INVALID", "NOT_TRANSLATABLE", "ALLOW_ALL", "ALLOW_NONE", "DENY_ALL", "DENY_NONE"
+    #   resp.policy_generation_assets[0].findings[0].description #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ListPolicyGenerationAssets AWS API Documentation
+    #
+    # @overload list_policy_generation_assets(params = {})
+    # @param [Hash] params ({})
+    def list_policy_generation_assets(params = {}, options = {})
+      req = build_request(:list_policy_generation_assets, params)
+      req.send_request(options)
+    end
+
+    # Retrieves a list of policy generation requests within the AgentCore
+    # Policy system. This operation supports pagination and filtering to
+    # help track and manage AI-powered policy generation operations.
+    #
+    # @option params [String] :next_token
+    #   A pagination token for retrieving additional policy generations when
+    #   results are paginated.
+    #
+    # @option params [Integer] :max_results
+    #   The maximum number of policy generations to return in a single
+    #   response.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The identifier of the policy engine whose policy generations to
+    #   retrieve.
+    #
+    # @return [Types::ListPolicyGenerationsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListPolicyGenerationsResponse#policy_generations #policy_generations} => Array&lt;Types::PolicyGeneration&gt;
+    #   * {Types::ListPolicyGenerationsResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_policy_generations({
+    #     next_token: "NextToken",
+    #     max_results: 1,
+    #     policy_engine_id: "ResourceId", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_generations #=> Array
+    #   resp.policy_generations[0].policy_engine_id #=> String
+    #   resp.policy_generations[0].policy_generation_id #=> String
+    #   resp.policy_generations[0].name #=> String
+    #   resp.policy_generations[0].policy_generation_arn #=> String
+    #   resp.policy_generations[0].resource.arn #=> String
+    #   resp.policy_generations[0].created_at #=> Time
+    #   resp.policy_generations[0].updated_at #=> Time
+    #   resp.policy_generations[0].status #=> String, one of "GENERATING", "GENERATED", "GENERATE_FAILED", "DELETE_FAILED"
+    #   resp.policy_generations[0].status_reasons #=> Array
+    #   resp.policy_generations[0].status_reasons[0] #=> String
+    #   resp.policy_generations[0].findings #=> String
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/ListPolicyGenerations AWS API Documentation
     #
-    # @overload list_oauth_2_credential_providers(params = {})
+    # @overload list_policy_generations(params = {})
     # @param [Hash] params ({})
-    def list_oauth_2_credential_providers(params = {}, options = {})
-      req = build_request(:list_oauth_2_credential_providers, params)
+    def list_policy_generations(params = {}, options = {})
+      req = build_request(:list_policy_generations, params)
       req.send_request(options)
     end
 
@@ -3228,6 +4735,45 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Creates or updates a resource-based policy for a resource with the
+    # specified resourceArn.
+    #
+    # <note markdown="1"> This feature is currently available only for AgentCore Runtime and
+    # Gateway.
+    #
+    #  </note>
+    #
+    # @option params [required, String] :resource_arn
+    #   The Amazon Resource Name (ARN) of the resource for which to create or
+    #   update the resource policy.
+    #
+    # @option params [required, String] :policy
+    #   The resource policy to create or update.
+    #
+    # @return [Types::PutResourcePolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::PutResourcePolicyResponse#policy #policy} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.put_resource_policy({
+    #     resource_arn: "BedrockAgentcoreResourceArn", # required
+    #     policy: "ResourcePolicyBody", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/PutResourcePolicy AWS API Documentation
+    #
+    # @overload put_resource_policy(params = {})
+    # @param [Hash] params ({})
+    def put_resource_policy(params = {}, options = {})
+      req = build_request(:put_resource_policy, params)
+      req.send_request(options)
+    end
+
     # Sets the customer master key (CMK) for a token vault.
     #
     # @option params [String] :token_vault_id
@@ -3269,6 +4815,102 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Initiates the AI-powered generation of Cedar policies from natural
+    # language descriptions within the AgentCore Policy system. This feature
+    # enables both technical and non-technical users to create policies by
+    # describing their authorization requirements in plain English, which is
+    # then automatically translated into formal Cedar policy statements. The
+    # generation process analyzes the natural language input along with the
+    # Gateway's tool context to produce validated policy options. Generated
+    # policy assets are automatically deleted after 7 days, so you should
+    # review and create policies from the generated assets within this
+    # timeframe. Once created, policies are permanent and not subject to
+    # this expiration. Generated policies should be reviewed and tested in
+    # log-only mode before deploying to production. Use this when you want
+    # to describe policy intent naturally rather than learning Cedar syntax,
+    # though generated policies may require refinement for complex
+    # scenarios.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The identifier of the policy engine that provides the context for
+    #   policy generation. This engine's schema and tool context are used to
+    #   ensure generated policies are valid and applicable.
+    #
+    # @option params [required, Types::Resource] :resource
+    #   The resource information that provides context for policy generation.
+    #   This helps the AI understand the target resources and generate
+    #   appropriate access control rules.
+    #
+    # @option params [required, Types::Content] :content
+    #   The natural language description of the desired policy behavior. This
+    #   content is processed by AI to generate corresponding Cedar policy
+    #   statements that match the described intent.
+    #
+    # @option params [required, String] :name
+    #   A customer-assigned name for the policy generation request. This helps
+    #   track and identify generation operations, especially when running
+    #   multiple generations simultaneously.
+    #
+    # @option params [String] :client_token
+    #   A unique, case-sensitive identifier to ensure the idempotency of the
+    #   request. The AWS SDK automatically generates this token, so you don't
+    #   need to provide it in most cases. If you retry a request with the same
+    #   client token, the service returns the same response without starting a
+    #   duplicate generation.
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    # @return [Types::StartPolicyGenerationResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::StartPolicyGenerationResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::StartPolicyGenerationResponse#policy_generation_id #policy_generation_id} => String
+    #   * {Types::StartPolicyGenerationResponse#name #name} => String
+    #   * {Types::StartPolicyGenerationResponse#policy_generation_arn #policy_generation_arn} => String
+    #   * {Types::StartPolicyGenerationResponse#resource #resource} => Types::Resource
+    #   * {Types::StartPolicyGenerationResponse#created_at #created_at} => Time
+    #   * {Types::StartPolicyGenerationResponse#updated_at #updated_at} => Time
+    #   * {Types::StartPolicyGenerationResponse#status #status} => String
+    #   * {Types::StartPolicyGenerationResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #   * {Types::StartPolicyGenerationResponse#findings #findings} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.start_policy_generation({
+    #     policy_engine_id: "ResourceId", # required
+    #     resource: { # required
+    #       arn: "BedrockAgentcoreResourceArn",
+    #     },
+    #     content: { # required
+    #       raw_text: "NaturalLanguage",
+    #     },
+    #     name: "PolicyGenerationName", # required
+    #     client_token: "ClientToken",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_engine_id #=> String
+    #   resp.policy_generation_id #=> String
+    #   resp.name #=> String
+    #   resp.policy_generation_arn #=> String
+    #   resp.resource.arn #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.status #=> String, one of "GENERATING", "GENERATED", "GENERATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #   resp.findings #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/StartPolicyGeneration AWS API Documentation
+    #
+    # @overload start_policy_generation(params = {})
+    # @param [Hash] params ({})
+    def start_policy_generation(params = {}, options = {})
+      req = build_request(:start_policy_generation, params)
+      req.send_request(options)
+    end
+
     # The gateway targets.
     #
     # @option params [required, String] :gateway_identifier
@@ -3327,6 +4969,17 @@ module Aws::BedrockAgentCoreControl
     #   resp.targets[0].target_configuration.mcp.lambda.tool_schema.inline_payload[0].output_schema.items #=> Types::SchemaDefinition
     #   resp.targets[0].target_configuration.mcp.lambda.tool_schema.inline_payload[0].output_schema.description #=> String
     #   resp.targets[0].target_configuration.mcp.mcp_server.endpoint #=> String
+    #   resp.targets[0].target_configuration.mcp.api_gateway.rest_api_id #=> String
+    #   resp.targets[0].target_configuration.mcp.api_gateway.stage #=> String
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides #=> Array
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].name #=> String
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].description #=> String
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].path #=> String
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].method #=> String, one of "GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "PUT", "POST"
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters #=> Array
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].filter_path #=> String
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].methods #=> Array
+    #   resp.targets[0].target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].methods[0] #=> String, one of "GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "PUT", "POST"
     #   resp.targets[0].credential_provider_configurations #=> Array
     #   resp.targets[0].credential_provider_configurations[0].credential_provider_type #=> String, one of "GATEWAY_IAM_ROLE", "OAUTH", "API_KEY"
     #   resp.targets[0].credential_provider_configurations[0].credential_provider.oauth_credential_provider.provider_arn #=> String
@@ -3334,6 +4987,8 @@ module Aws::BedrockAgentCoreControl
     #   resp.targets[0].credential_provider_configurations[0].credential_provider.oauth_credential_provider.scopes[0] #=> String
     #   resp.targets[0].credential_provider_configurations[0].credential_provider.oauth_credential_provider.custom_parameters #=> Hash
     #   resp.targets[0].credential_provider_configurations[0].credential_provider.oauth_credential_provider.custom_parameters["OAuthCustomParametersKey"] #=> String
+    #   resp.targets[0].credential_provider_configurations[0].credential_provider.oauth_credential_provider.grant_type #=> String, one of "CLIENT_CREDENTIALS", "AUTHORIZATION_CODE"
+    #   resp.targets[0].credential_provider_configurations[0].credential_provider.oauth_credential_provider.default_return_url #=> String
     #   resp.targets[0].credential_provider_configurations[0].credential_provider.api_key_credential_provider.provider_arn #=> String
     #   resp.targets[0].credential_provider_configurations[0].credential_provider.api_key_credential_provider.credential_parameter_name #=> String
     #   resp.targets[0].credential_provider_configurations[0].credential_provider.api_key_credential_provider.credential_prefix #=> String
@@ -3503,6 +5158,20 @@ module Aws::BedrockAgentCoreControl
     #         discovery_url: "DiscoveryUrl", # required
     #         allowed_audience: ["AllowedAudience"],
     #         allowed_clients: ["AllowedClient"],
+    #         allowed_scopes: ["AllowedScopeType"],
+    #         custom_claims: [
+    #           {
+    #             inbound_token_claim_name: "InboundTokenClaimNameType", # required
+    #             inbound_token_claim_value_type: "STRING", # required, accepts STRING, STRING_ARRAY
+    #             authorizing_claim_match_value: { # required
+    #               claim_match_value: { # required
+    #                 match_value_string: "MatchValueString",
+    #                 match_value_string_list: ["MatchValueString"],
+    #               },
+    #               claim_match_operator: "EQUALS", # required, accepts EQUALS, CONTAINS, CONTAINS_ANY
+    #             },
+    #           },
+    #         ],
     #       },
     #     },
     #     request_header_configuration: {
@@ -3642,6 +5311,103 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Updates a custom evaluator's configuration, description, or
+    # evaluation level. Built-in evaluators cannot be updated. The evaluator
+    # must not be locked for modification.
+    #
+    # @option params [String] :client_token
+    #   A unique, case-sensitive identifier to ensure that the API request
+    #   completes no more than one time. If you don't specify this field, a
+    #   value is randomly generated for you. If this token matches a previous
+    #   request, the service ignores the request, but doesn't return an
+    #   error. For more information, see [Ensuring idempotency][1].
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html
+    #
+    # @option params [required, String] :evaluator_id
+    #   The unique identifier of the evaluator to update.
+    #
+    # @option params [String] :description
+    #   The updated description of the evaluator.
+    #
+    # @option params [Types::EvaluatorConfig] :evaluator_config
+    #   The updated configuration for the evaluator, including LLM-as-a-Judge
+    #   settings with instructions, rating scale, and model configuration.
+    #
+    # @option params [String] :level
+    #   The updated evaluation level (`TOOL_CALL`, `TRACE`, or `SESSION`) that
+    #   determines the scope of evaluation.
+    #
+    # @return [Types::UpdateEvaluatorResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::UpdateEvaluatorResponse#evaluator_arn #evaluator_arn} => String
+    #   * {Types::UpdateEvaluatorResponse#evaluator_id #evaluator_id} => String
+    #   * {Types::UpdateEvaluatorResponse#updated_at #updated_at} => Time
+    #   * {Types::UpdateEvaluatorResponse#status #status} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.update_evaluator({
+    #     client_token: "ClientToken",
+    #     evaluator_id: "EvaluatorId", # required
+    #     description: "EvaluatorDescription",
+    #     evaluator_config: {
+    #       llm_as_a_judge: {
+    #         instructions: "EvaluatorInstructions", # required
+    #         rating_scale: { # required
+    #           numerical: [
+    #             {
+    #               definition: "String", # required
+    #               value: 1.0, # required
+    #               label: "NumericalScaleDefinitionLabelString", # required
+    #             },
+    #           ],
+    #           categorical: [
+    #             {
+    #               definition: "String", # required
+    #               label: "CategoricalScaleDefinitionLabelString", # required
+    #             },
+    #           ],
+    #         },
+    #         model_config: { # required
+    #           bedrock_evaluator_model_config: {
+    #             model_id: "ModelId", # required
+    #             inference_config: {
+    #               max_tokens: 1,
+    #               temperature: 1.0,
+    #               top_p: 1.0,
+    #               stop_sequences: ["NonEmptyString"],
+    #             },
+    #             additional_model_request_fields: {
+    #             },
+    #           },
+    #         },
+    #       },
+    #     },
+    #     level: "TOOL_CALL", # accepts TOOL_CALL, TRACE, SESSION
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.evaluator_arn #=> String
+    #   resp.evaluator_id #=> String
+    #   resp.updated_at #=> Time
+    #   resp.status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/UpdateEvaluator AWS API Documentation
+    #
+    # @overload update_evaluator(params = {})
+    # @param [Hash] params ({})
+    def update_evaluator(params = {}, options = {})
+      req = build_request(:update_evaluator, params)
+      req.send_request(options)
+    end
+
     # Updates an existing gateway.
     #
     # @option params [required, String] :gateway_identifier
@@ -3673,6 +5439,16 @@ module Aws::BedrockAgentCoreControl
     # @option params [String] :kms_key_arn
     #   The updated ARN of the KMS key used to encrypt the gateway.
     #
+    # @option params [Array<Types::GatewayInterceptorConfiguration>] :interceptor_configurations
+    #   The updated interceptor configurations for the gateway.
+    #
+    # @option params [Types::GatewayPolicyEngineConfiguration] :policy_engine_configuration
+    #   The updated policy engine configuration for the gateway. A policy
+    #   engine is a collection of policies that evaluates and authorizes agent
+    #   tool calls. When associated with a gateway, the policy engine
+    #   intercepts all agent requests and determines whether to allow or deny
+    #   each action based on the defined policies.
+    #
     # @option params [String] :exception_level
     #   The level of detail in error messages returned when invoking the
     #   gateway.
@@ -3700,6 +5476,8 @@ module Aws::BedrockAgentCoreControl
     #   * {Types::UpdateGatewayResponse#authorizer_type #authorizer_type} => String
     #   * {Types::UpdateGatewayResponse#authorizer_configuration #authorizer_configuration} => Types::AuthorizerConfiguration
     #   * {Types::UpdateGatewayResponse#kms_key_arn #kms_key_arn} => String
+    #   * {Types::UpdateGatewayResponse#interceptor_configurations #interceptor_configurations} => Array&lt;Types::GatewayInterceptorConfiguration&gt;
+    #   * {Types::UpdateGatewayResponse#policy_engine_configuration #policy_engine_configuration} => Types::GatewayPolicyEngineConfiguration
     #   * {Types::UpdateGatewayResponse#workload_identity_details #workload_identity_details} => Types::WorkloadIdentityDetails
     #   * {Types::UpdateGatewayResponse#exception_level #exception_level} => String
     #
@@ -3718,15 +5496,46 @@ module Aws::BedrockAgentCoreControl
     #         search_type: "SEMANTIC", # accepts SEMANTIC
     #       },
     #     },
-    #     authorizer_type: "CUSTOM_JWT", # required, accepts CUSTOM_JWT, AWS_IAM
+    #     authorizer_type: "CUSTOM_JWT", # required, accepts CUSTOM_JWT, AWS_IAM, NONE
     #     authorizer_configuration: {
     #       custom_jwt_authorizer: {
     #         discovery_url: "DiscoveryUrl", # required
     #         allowed_audience: ["AllowedAudience"],
     #         allowed_clients: ["AllowedClient"],
+    #         allowed_scopes: ["AllowedScopeType"],
+    #         custom_claims: [
+    #           {
+    #             inbound_token_claim_name: "InboundTokenClaimNameType", # required
+    #             inbound_token_claim_value_type: "STRING", # required, accepts STRING, STRING_ARRAY
+    #             authorizing_claim_match_value: { # required
+    #               claim_match_value: { # required
+    #                 match_value_string: "MatchValueString",
+    #                 match_value_string_list: ["MatchValueString"],
+    #               },
+    #               claim_match_operator: "EQUALS", # required, accepts EQUALS, CONTAINS, CONTAINS_ANY
+    #             },
+    #           },
+    #         ],
     #       },
     #     },
     #     kms_key_arn: "KmsKeyArn",
+    #     interceptor_configurations: [
+    #       {
+    #         interceptor: { # required
+    #           lambda: {
+    #             arn: "LambdaFunctionArn", # required
+    #           },
+    #         },
+    #         interception_points: ["REQUEST"], # required, accepts REQUEST, RESPONSE
+    #         input_configuration: {
+    #           pass_request_headers: false, # required
+    #         },
+    #       },
+    #     ],
+    #     policy_engine_configuration: {
+    #       arn: "GatewayPolicyEngineArn", # required
+    #       mode: "LOG_ONLY", # required, accepts LOG_ONLY, ENFORCE
+    #     },
     #     exception_level: "DEBUG", # accepts DEBUG
     #   })
     #
@@ -3748,13 +5557,29 @@ module Aws::BedrockAgentCoreControl
     #   resp.protocol_configuration.mcp.supported_versions[0] #=> String
     #   resp.protocol_configuration.mcp.instructions #=> String
     #   resp.protocol_configuration.mcp.search_type #=> String, one of "SEMANTIC"
-    #   resp.authorizer_type #=> String, one of "CUSTOM_JWT", "AWS_IAM"
+    #   resp.authorizer_type #=> String, one of "CUSTOM_JWT", "AWS_IAM", "NONE"
     #   resp.authorizer_configuration.custom_jwt_authorizer.discovery_url #=> String
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_audience #=> Array
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_audience[0] #=> String
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_clients #=> Array
     #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_clients[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_scopes #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.allowed_scopes[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].inbound_token_claim_name #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].inbound_token_claim_value_type #=> String, one of "STRING", "STRING_ARRAY"
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string_list #=> Array
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_value.match_value_string_list[0] #=> String
+    #   resp.authorizer_configuration.custom_jwt_authorizer.custom_claims[0].authorizing_claim_match_value.claim_match_operator #=> String, one of "EQUALS", "CONTAINS", "CONTAINS_ANY"
     #   resp.kms_key_arn #=> String
+    #   resp.interceptor_configurations #=> Array
+    #   resp.interceptor_configurations[0].interceptor.lambda.arn #=> String
+    #   resp.interceptor_configurations[0].interception_points #=> Array
+    #   resp.interceptor_configurations[0].interception_points[0] #=> String, one of "REQUEST", "RESPONSE"
+    #   resp.interceptor_configurations[0].input_configuration.pass_request_headers #=> Boolean
+    #   resp.policy_engine_configuration.arn #=> String
+    #   resp.policy_engine_configuration.mode #=> String, one of "LOG_ONLY", "ENFORCE"
     #   resp.workload_identity_details.workload_identity_arn #=> String
     #   resp.exception_level #=> String, one of "DEBUG"
     #
@@ -3869,6 +5694,26 @@ module Aws::BedrockAgentCoreControl
     #         mcp_server: {
     #           endpoint: "McpServerTargetConfigurationEndpointString", # required
     #         },
+    #         api_gateway: {
+    #           rest_api_id: "String", # required
+    #           stage: "String", # required
+    #           api_gateway_tool_configuration: { # required
+    #             tool_overrides: [
+    #               {
+    #                 name: "String", # required
+    #                 description: "String",
+    #                 path: "String", # required
+    #                 method: "GET", # required, accepts GET, DELETE, HEAD, OPTIONS, PATCH, PUT, POST
+    #               },
+    #             ],
+    #             tool_filters: [ # required
+    #               {
+    #                 filter_path: "String", # required
+    #                 methods: ["GET"], # required, accepts GET, DELETE, HEAD, OPTIONS, PATCH, PUT, POST
+    #               },
+    #             ],
+    #           },
+    #         },
     #       },
     #     },
     #     credential_provider_configurations: [
@@ -3881,6 +5726,8 @@ module Aws::BedrockAgentCoreControl
     #             custom_parameters: {
     #               "OAuthCustomParametersKey" => "OAuthCustomParametersValue",
     #             },
+    #             grant_type: "CLIENT_CREDENTIALS", # accepts CLIENT_CREDENTIALS, AUTHORIZATION_CODE
+    #             default_return_url: "OAuthDefaultReturnUrl",
     #           },
     #           api_key_credential_provider: {
     #             provider_arn: "ApiKeyCredentialProviderArn", # required
@@ -3931,6 +5778,17 @@ module Aws::BedrockAgentCoreControl
     #   resp.target_configuration.mcp.lambda.tool_schema.inline_payload[0].output_schema.items #=> Types::SchemaDefinition
     #   resp.target_configuration.mcp.lambda.tool_schema.inline_payload[0].output_schema.description #=> String
     #   resp.target_configuration.mcp.mcp_server.endpoint #=> String
+    #   resp.target_configuration.mcp.api_gateway.rest_api_id #=> String
+    #   resp.target_configuration.mcp.api_gateway.stage #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].name #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].description #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].path #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_overrides[0].method #=> String, one of "GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "PUT", "POST"
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].filter_path #=> String
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].methods #=> Array
+    #   resp.target_configuration.mcp.api_gateway.api_gateway_tool_configuration.tool_filters[0].methods[0] #=> String, one of "GET", "DELETE", "HEAD", "OPTIONS", "PATCH", "PUT", "POST"
     #   resp.credential_provider_configurations #=> Array
     #   resp.credential_provider_configurations[0].credential_provider_type #=> String, one of "GATEWAY_IAM_ROLE", "OAUTH", "API_KEY"
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.provider_arn #=> String
@@ -3938,6 +5796,8 @@ module Aws::BedrockAgentCoreControl
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.scopes[0] #=> String
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.custom_parameters #=> Hash
     #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.custom_parameters["OAuthCustomParametersKey"] #=> String
+    #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.grant_type #=> String, one of "CLIENT_CREDENTIALS", "AUTHORIZATION_CODE"
+    #   resp.credential_provider_configurations[0].credential_provider.oauth_credential_provider.default_return_url #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.provider_arn #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.credential_parameter_name #=> String
     #   resp.credential_provider_configurations[0].credential_provider.api_key_credential_provider.credential_prefix #=> String
@@ -4041,6 +5901,21 @@ module Aws::BedrockAgentCoreControl
     #                   model_id: "String", # required
     #                 },
     #               },
+    #               episodic_override: {
+    #                 extraction: {
+    #                   append_to_prompt: "Prompt", # required
+    #                   model_id: "String", # required
+    #                 },
+    #                 consolidation: {
+    #                   append_to_prompt: "Prompt", # required
+    #                   model_id: "String", # required
+    #                 },
+    #                 reflection: {
+    #                   append_to_prompt: "Prompt", # required
+    #                   model_id: "String", # required
+    #                   namespaces: ["Namespace"],
+    #                 },
+    #               },
     #               self_managed_configuration: {
     #                 trigger_conditions: [
     #                   {
@@ -4063,6 +5938,14 @@ module Aws::BedrockAgentCoreControl
     #               },
     #             },
     #           },
+    #           episodic_memory_strategy: {
+    #             name: "Name", # required
+    #             description: "Description",
+    #             namespaces: ["Namespace"],
+    #             reflection_configuration: {
+    #               namespaces: ["Namespace"], # required
+    #             },
+    #           },
     #         },
     #       ],
     #       modify_memory_strategies: [
@@ -4081,6 +5964,10 @@ module Aws::BedrockAgentCoreControl
     #                   append_to_prompt: "Prompt", # required
     #                   model_id: "String", # required
     #                 },
+    #                 episodic_extraction_override: {
+    #                   append_to_prompt: "Prompt", # required
+    #                   model_id: "String", # required
+    #                 },
     #               },
     #             },
     #             consolidation: {
@@ -4097,6 +5984,22 @@ module Aws::BedrockAgentCoreControl
     #                   append_to_prompt: "Prompt", # required
     #                   model_id: "String", # required
     #                 },
+    #                 episodic_consolidation_override: {
+    #                   append_to_prompt: "Prompt", # required
+    #                   model_id: "String", # required
+    #                 },
+    #               },
+    #             },
+    #             reflection: {
+    #               episodic_reflection_configuration: {
+    #                 namespaces: ["Namespace"], # required
+    #               },
+    #               custom_reflection_configuration: {
+    #                 episodic_reflection_override: {
+    #                   append_to_prompt: "Prompt", # required
+    #                   model_id: "String", # required
+    #                   namespaces: ["Namespace"],
+    #                 },
     #               },
     #             },
     #             self_managed_configuration: {
@@ -4147,17 +6050,27 @@ module Aws::BedrockAgentCoreControl
     #   resp.memory.strategies[0].strategy_id #=> String
     #   resp.memory.strategies[0].name #=> String
     #   resp.memory.strategies[0].description #=> String
-    #   resp.memory.strategies[0].configuration.type #=> String, one of "SEMANTIC_OVERRIDE", "SUMMARY_OVERRIDE", "USER_PREFERENCE_OVERRIDE", "SELF_MANAGED"
+    #   resp.memory.strategies[0].configuration.type #=> String, one of "SEMANTIC_OVERRIDE", "SUMMARY_OVERRIDE", "USER_PREFERENCE_OVERRIDE", "SELF_MANAGED", "EPISODIC_OVERRIDE"
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.semantic_extraction_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.semantic_extraction_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.user_preference_extraction_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.user_preference_extraction_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.episodic_extraction_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.extraction.custom_extraction_configuration.episodic_extraction_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.semantic_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.semantic_consolidation_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.summary_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.summary_consolidation_override.model_id #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.user_preference_consolidation_override.append_to_prompt #=> String
     #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.user_preference_consolidation_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.episodic_consolidation_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.consolidation.custom_consolidation_configuration.episodic_consolidation_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.append_to_prompt #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.model_id #=> String
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.namespaces #=> Array
+    #   resp.memory.strategies[0].configuration.reflection.custom_reflection_configuration.episodic_reflection_override.namespaces[0] #=> String
+    #   resp.memory.strategies[0].configuration.reflection.episodic_reflection_configuration.namespaces #=> Array
+    #   resp.memory.strategies[0].configuration.reflection.episodic_reflection_configuration.namespaces[0] #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions #=> Array
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions[0].message_based_trigger.message_count #=> Integer
     #   resp.memory.strategies[0].configuration.self_managed_configuration.trigger_conditions[0].token_based_trigger.token_count #=> Integer
@@ -4165,7 +6078,7 @@ module Aws::BedrockAgentCoreControl
     #   resp.memory.strategies[0].configuration.self_managed_configuration.invocation_configuration.topic_arn #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.invocation_configuration.payload_delivery_bucket_name #=> String
     #   resp.memory.strategies[0].configuration.self_managed_configuration.historical_context_window_size #=> Integer
-    #   resp.memory.strategies[0].type #=> String, one of "SEMANTIC", "SUMMARIZATION", "USER_PREFERENCE", "CUSTOM"
+    #   resp.memory.strategies[0].type #=> String, one of "SEMANTIC", "SUMMARIZATION", "USER_PREFERENCE", "CUSTOM", "EPISODIC"
     #   resp.memory.strategies[0].namespaces #=> Array
     #   resp.memory.strategies[0].namespaces[0] #=> String
     #   resp.memory.strategies[0].created_at #=> Time
@@ -4362,6 +6275,254 @@ module Aws::BedrockAgentCoreControl
       req.send_request(options)
     end
 
+    # Updates an online evaluation configuration's settings, including
+    # rules, data sources, evaluators, and execution status. Changes take
+    # effect immediately for ongoing evaluations.
+    #
+    # @option params [String] :client_token
+    #   A unique, case-sensitive identifier to ensure that the API request
+    #   completes no more than one time. If you don't specify this field, a
+    #   value is randomly generated for you. If this token matches a previous
+    #   request, the service ignores the request, but doesn't return an
+    #   error. For more information, see [Ensuring idempotency][1].
+    #
+    #   **A suitable default value is auto-generated.** You should normally
+    #   not need to pass this option.**
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html
+    #
+    # @option params [required, String] :online_evaluation_config_id
+    #   The unique identifier of the online evaluation configuration to
+    #   update.
+    #
+    # @option params [String] :description
+    #   The updated description of the online evaluation configuration.
+    #
+    # @option params [Types::Rule] :rule
+    #   The updated evaluation rule containing sampling configuration,
+    #   filters, and session settings.
+    #
+    # @option params [Types::DataSourceConfig] :data_source_config
+    #   The updated data source configuration specifying CloudWatch log groups
+    #   and service names to monitor.
+    #
+    # @option params [Array<Types::EvaluatorReference>] :evaluators
+    #   The updated list of evaluators to apply during online evaluation.
+    #
+    # @option params [String] :evaluation_execution_role_arn
+    #   The updated Amazon Resource Name (ARN) of the IAM role used for
+    #   evaluation execution.
+    #
+    # @option params [String] :execution_status
+    #   The updated execution status to enable or disable the online
+    #   evaluation.
+    #
+    # @return [Types::UpdateOnlineEvaluationConfigResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::UpdateOnlineEvaluationConfigResponse#online_evaluation_config_arn #online_evaluation_config_arn} => String
+    #   * {Types::UpdateOnlineEvaluationConfigResponse#online_evaluation_config_id #online_evaluation_config_id} => String
+    #   * {Types::UpdateOnlineEvaluationConfigResponse#updated_at #updated_at} => Time
+    #   * {Types::UpdateOnlineEvaluationConfigResponse#status #status} => String
+    #   * {Types::UpdateOnlineEvaluationConfigResponse#execution_status #execution_status} => String
+    #   * {Types::UpdateOnlineEvaluationConfigResponse#failure_reason #failure_reason} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.update_online_evaluation_config({
+    #     client_token: "ClientToken",
+    #     online_evaluation_config_id: "OnlineEvaluationConfigId", # required
+    #     description: "EvaluationConfigDescription",
+    #     rule: {
+    #       sampling_config: { # required
+    #         sampling_percentage: 1.0, # required
+    #       },
+    #       filters: [
+    #         {
+    #           key: "FilterKeyString", # required
+    #           operator: "Equals", # required, accepts Equals, NotEquals, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, Contains, NotContains
+    #           value: { # required
+    #             string_value: "FilterValueStringValueString",
+    #             double_value: 1.0,
+    #             boolean_value: false,
+    #           },
+    #         },
+    #       ],
+    #       session_config: {
+    #         session_timeout_minutes: 1, # required
+    #       },
+    #     },
+    #     data_source_config: {
+    #       cloud_watch_logs: {
+    #         log_group_names: ["LogGroupName"], # required
+    #         service_names: ["ServiceName"], # required
+    #       },
+    #     },
+    #     evaluators: [
+    #       {
+    #         evaluator_id: "EvaluatorId",
+    #       },
+    #     ],
+    #     evaluation_execution_role_arn: "RoleArn",
+    #     execution_status: "ENABLED", # accepts ENABLED, DISABLED
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.online_evaluation_config_arn #=> String
+    #   resp.online_evaluation_config_id #=> String
+    #   resp.updated_at #=> Time
+    #   resp.status #=> String, one of "ACTIVE", "CREATING", "CREATE_FAILED", "UPDATING", "UPDATE_FAILED", "DELETING"
+    #   resp.execution_status #=> String, one of "ENABLED", "DISABLED"
+    #   resp.failure_reason #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/UpdateOnlineEvaluationConfig AWS API Documentation
+    #
+    # @overload update_online_evaluation_config(params = {})
+    # @param [Hash] params ({})
+    def update_online_evaluation_config(params = {}, options = {})
+      req = build_request(:update_online_evaluation_config, params)
+      req.send_request(options)
+    end
+
+    # Updates an existing policy within the AgentCore Policy system. This
+    # operation allows modification of the policy description and definition
+    # while maintaining the policy's identity. The updated policy is
+    # validated against the Cedar schema before being applied. This is an
+    # asynchronous operation. Use the `GetPolicy` operation to poll the
+    # `status` field to track completion.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The identifier of the policy engine that manages the policy to be
+    #   updated. This ensures the policy is updated within the correct policy
+    #   engine context.
+    #
+    # @option params [required, String] :policy_id
+    #   The unique identifier of the policy to be updated. This must be a
+    #   valid policy ID that exists within the specified policy engine.
+    #
+    # @option params [String] :description
+    #   The new human-readable description for the policy. This optional field
+    #   allows updating the policy's documentation while keeping the same
+    #   policy logic.
+    #
+    # @option params [required, Types::PolicyDefinition] :definition
+    #   The new Cedar policy statement that defines the access control rules.
+    #   This replaces the existing policy definition with new logic while
+    #   maintaining the policy's identity.
+    #
+    # @option params [String] :validation_mode
+    #   The validation mode for the policy update. Determines how Cedar
+    #   analyzer validation results are handled during policy updates.
+    #   FAIL\_ON\_ANY\_FINDINGS runs the Cedar analyzer and fails the update
+    #   if validation issues are detected, ensuring the policy conforms to the
+    #   Cedar schema and tool context. IGNORE\_ALL\_FINDINGS runs the Cedar
+    #   analyzer but allows updates despite validation warnings. Use
+    #   FAIL\_ON\_ANY\_FINDINGS to ensure policy correctness during updates,
+    #   especially when modifying policy logic or conditions.
+    #
+    # @return [Types::UpdatePolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::UpdatePolicyResponse#policy_id #policy_id} => String
+    #   * {Types::UpdatePolicyResponse#name #name} => String
+    #   * {Types::UpdatePolicyResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::UpdatePolicyResponse#definition #definition} => Types::PolicyDefinition
+    #   * {Types::UpdatePolicyResponse#description #description} => String
+    #   * {Types::UpdatePolicyResponse#created_at #created_at} => Time
+    #   * {Types::UpdatePolicyResponse#updated_at #updated_at} => Time
+    #   * {Types::UpdatePolicyResponse#policy_arn #policy_arn} => String
+    #   * {Types::UpdatePolicyResponse#status #status} => String
+    #   * {Types::UpdatePolicyResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.update_policy({
+    #     policy_engine_id: "ResourceId", # required
+    #     policy_id: "ResourceId", # required
+    #     description: "Description",
+    #     definition: { # required
+    #       cedar: {
+    #         statement: "Statement", # required
+    #       },
+    #     },
+    #     validation_mode: "FAIL_ON_ANY_FINDINGS", # accepts FAIL_ON_ANY_FINDINGS, IGNORE_ALL_FINDINGS
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_id #=> String
+    #   resp.name #=> String
+    #   resp.policy_engine_id #=> String
+    #   resp.definition.cedar.statement #=> String
+    #   resp.description #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.policy_arn #=> String
+    #   resp.status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/UpdatePolicy AWS API Documentation
+    #
+    # @overload update_policy(params = {})
+    # @param [Hash] params ({})
+    def update_policy(params = {}, options = {})
+      req = build_request(:update_policy, params)
+      req.send_request(options)
+    end
+
+    # Updates an existing policy engine within the AgentCore Policy system.
+    # This operation allows modification of the policy engine description
+    # while maintaining its identity. This is an asynchronous operation. Use
+    # the `GetPolicyEngine` operation to poll the `status` field to track
+    # completion.
+    #
+    # @option params [required, String] :policy_engine_id
+    #   The unique identifier of the policy engine to be updated.
+    #
+    # @option params [String] :description
+    #   The new description for the policy engine.
+    #
+    # @return [Types::UpdatePolicyEngineResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::UpdatePolicyEngineResponse#policy_engine_id #policy_engine_id} => String
+    #   * {Types::UpdatePolicyEngineResponse#name #name} => String
+    #   * {Types::UpdatePolicyEngineResponse#description #description} => String
+    #   * {Types::UpdatePolicyEngineResponse#created_at #created_at} => Time
+    #   * {Types::UpdatePolicyEngineResponse#updated_at #updated_at} => Time
+    #   * {Types::UpdatePolicyEngineResponse#policy_engine_arn #policy_engine_arn} => String
+    #   * {Types::UpdatePolicyEngineResponse#status #status} => String
+    #   * {Types::UpdatePolicyEngineResponse#status_reasons #status_reasons} => Array&lt;String&gt;
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.update_policy_engine({
+    #     policy_engine_id: "ResourceId", # required
+    #     description: "Description",
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.policy_engine_id #=> String
+    #   resp.name #=> String
+    #   resp.description #=> String
+    #   resp.created_at #=> Time
+    #   resp.updated_at #=> Time
+    #   resp.policy_engine_arn #=> String
+    #   resp.status #=> String, one of "CREATING", "ACTIVE", "UPDATING", "DELETING", "CREATE_FAILED", "UPDATE_FAILED", "DELETE_FAILED"
+    #   resp.status_reasons #=> Array
+    #   resp.status_reasons[0] #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agentcore-control-2023-06-05/UpdatePolicyEngine AWS API Documentation
+    #
+    # @overload update_policy_engine(params = {})
+    # @param [Hash] params ({})
+    def update_policy_engine(params = {}, options = {})
+      req = build_request(:update_policy_engine, params)
+      req.send_request(options)
+    end
+
     # Updates an existing workload identity.
     #
     # @option params [required, String] :name
@@ -4422,7 +6583,7 @@ module Aws::BedrockAgentCoreControl
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-bedrockagentcorecontrol'
-      context[:gem_version] = '1.14.0'
+      context[:gem_version] = '1.16.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 
@@ -4488,9 +6649,14 @@ module Aws::BedrockAgentCoreControl
     # The following table lists the valid waiter names, the operations they call,
     # and the default `:delay` and `:max_attempts` values.
     #
-    # | waiter_name    | params              | :delay   | :max_attempts |
-    # | -------------- | ------------------- | -------- | ------------- |
-    # | memory_created | {Client#get_memory} | 2        | 60            |
+    # | waiter_name                 | params                         | :delay   | :max_attempts |
+    # | --------------------------- | ------------------------------ | -------- | ------------- |
+    # | memory_created              | {Client#get_memory}            | 2        | 60            |
+    # | policy_active               | {Client#get_policy}            | 2        | 60            |
+    # | policy_deleted              | {Client#get_policy}            | 2        | 60            |
+    # | policy_engine_active        | {Client#get_policy_engine}     | 2        | 60            |
+    # | policy_engine_deleted       | {Client#get_policy_engine}     | 2        | 60            |
+    # | policy_generation_completed | {Client#get_policy_generation} | 2        | 60            |
     #
     # @raise [Errors::FailureStateError] Raised when the waiter terminates
     #   because the waiter has entered a state that it will not transition
@@ -4541,7 +6707,12 @@ module Aws::BedrockAgentCoreControl
 
     def waiters
       {
-        memory_created: Waiters::MemoryCreated
+        memory_created: Waiters::MemoryCreated,
+        policy_active: Waiters::PolicyActive,
+        policy_deleted: Waiters::PolicyDeleted,
+        policy_engine_active: Waiters::PolicyEngineActive,
+        policy_engine_deleted: Waiters::PolicyEngineDeleted,
+        policy_generation_completed: Waiters::PolicyGenerationCompleted
       }
     end