diff --git a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/gateway-base.ts b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/gateway-base.ts
index 06c0fe28ffb44..8ed1828340a3e 100644
--- a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/gateway-base.ts
+++ b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/gateway-base.ts
@@ -5,7 +5,7 @@ import * as kms from 'aws-cdk-lib/aws-kms';
 import { Construct } from 'constructs';
 // Internal imports
 import { IGatewayAuthorizerConfig } from './inbound-auth/authorizer';
-import { GatewayPerms } from './perms';
+import { GatewayPerms } from './private/perms';
 import { IGatewayProtocolConfig } from './protocol';
 
 /******************************************************************************
diff --git a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/gateway.ts b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/gateway.ts
index 15dc8f0ede8b1..6695875b6b248 100644
--- a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/gateway.ts
+++ b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/gateway.ts
@@ -11,7 +11,7 @@ import { Construct } from 'constructs';
 import { GatewayBase, GatewayExceptionLevel, IGateway } from './gateway-base';
 import { GatewayAuthorizer, IGatewayAuthorizerConfig } from './inbound-auth/authorizer';
 import { ICredentialProviderConfig } from './outbound-auth/credential-provider';
-import { GatewayPerms } from './perms';
+import { GatewayPerms } from './private/perms';
 import { IGatewayProtocolConfig, McpGatewaySearchType, McpProtocolConfiguration, MCPProtocolVersion } from './protocol';
 import { ApiSchema } from './targets/schema/api-schema';
 import { ToolSchema } from './targets/schema/tool-schema';
diff --git a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/outbound-auth/api-key.ts b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/outbound-auth/api-key.ts
index 4daf17cfa5f97..4d79773f98561 100644
--- a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/outbound-auth/api-key.ts
+++ b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/outbound-auth/api-key.ts
@@ -1,6 +1,6 @@
 import { Grant, IRole, PolicyStatement } from 'aws-cdk-lib/aws-iam';
 import { CredentialProviderType, ICredentialProviderConfig } from './credential-provider';
-import { GatewayPerms } from '../perms';
+import { GatewayPerms } from '../private/perms';
 
 /******************************************************************************
  *                                 API KEY
diff --git a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/outbound-auth/oauth.ts b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/outbound-auth/oauth.ts
index 217e17f26bab5..a6445500bc434 100644
--- a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/outbound-auth/oauth.ts
+++ b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/outbound-auth/oauth.ts
@@ -1,6 +1,6 @@
 import { Grant, IRole, PolicyStatement } from 'aws-cdk-lib/aws-iam';
 import { CredentialProviderType, ICredentialProviderConfig } from './credential-provider';
-import { GatewayPerms } from '../perms';
+import { GatewayPerms } from '../private/perms';
 
 /******************************************************************************
  *                                OAuth
diff --git a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/perms.ts b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/private/perms.ts
similarity index 100%
rename from packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/perms.ts
rename to packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/private/perms.ts
diff --git a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/targets/target.ts b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/targets/target.ts
index 52095a4d6770b..460edc8903674 100644
--- a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/targets/target.ts
+++ b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/gateway/targets/target.ts
@@ -6,7 +6,7 @@ import { addConstructMetadata, MethodMetadata } from 'aws-cdk-lib/core/lib/metad
 import { propertyInjectable } from 'aws-cdk-lib/core/lib/prop-injectable';
 import { Construct } from 'constructs';
 import { IGateway } from '../gateway-base';
-import { GatewayPerms } from '../perms';
+import { GatewayPerms } from '../private/perms';
 import { ApiSchema } from './schema/api-schema';
 import { ToolSchema } from './schema/tool-schema';
 import { GatewayTargetBase, GatewayTargetProtocolType, IGatewayTarget, IMcpGatewayTarget, McpTargetType } from './target-base';
diff --git a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/index.ts b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/index.ts
index cd51fcd7ca99b..c735db094d348 100644
--- a/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/index.ts
+++ b/packages/@aws-cdk/aws-bedrock-agentcore-alpha/agentcore/index.ts
@@ -28,8 +28,6 @@ export * from './tools/browser';
 // ===================================
 export * from './gateway/gateway-base';
 export * from './gateway/gateway';
-export * from './gateway/perms';
-export * from './gateway/protocol';
 // validation-helpers contains internal utilities and should not be exported
 
 // ===================================