Cedar could stop one bad tool call. Dogwood stops bad sequences.

AWS launched Dogwood this week - an open-source policy language (Apache 2.0) for AI agent runtime verification. It extends Cedar, AWS's existing authorization language (now a CNCF sandbox project), with something Cedar fundamentally can't do: reason about sequences of actions over time. "Point-in-time decisions make sense for many forms of access control, but when agents compose multiple actions into longer workflows, the sequence itself becomes something teams want to govern." That's the gap Dogwood fills. What Cedar couldn't do Cedar is stateless. You give it a request - principal, action, resource, parameters - and it returns allow or deny. Given the same request, Cedar always returns the same answer, regardless of what happened five minutes ago. That's a useful property for analysis, but it's a blind spot for agents. Consider: an agent is restricted to transferring no more than $5,000 per hour. If Cedar only evaluates the current request against completed transfers, the agent can fire off three concurrent $2,000 requests before any of them finish. Each looks fine in isolation. The total blows the limit. Dogwood has the event history. It counts all transfer requests - including those currently in-flight - so the third $2,000 request gets denied even before the first two complete. What Dogwood adds Dogwood introduces temporal conditions that examine earlier tool calls and their results. You can: - Check whether an event occurred - e.g., was approval granted for this exact stock/quantity in the last hour? - Count calls in a time window - rate limiting across concurrent requests - Count distinct values - e.g., how many unique payment recipients this session - Sum values - total transferred, total refunded The stock trading example from AWS is the clearest illustration: an agent may only sell shares if an approval tool returned a positive response for that stock and share count within the previous hour. That approval is a separate event the policy engine finds in the agent's history - the LLM doesn't touch the enforcement logic. How it integrates Dogwood extends Cedar, not replaces it. Any existing Cedar policy is a valid Dogwood policy - no rewrite needed. Temporal conditions translate to Cedar context fields that Dogwood populates from the event history before Cedar runs. For Bedrock AgentCore users, Dogwood is already integrated - AWS can generate the action schema from tools in AgentCore Gateway's MCP manifest. The open-source reference implementation and the language spec are at github.com/dogwood-policy/dogwood. The caveats The reference implementation is for exploration and testing, not production. For production use you'd need to provide: trusted timestamps, authenticated events, consistent action naming, durable trace storage, per-tenant history isolation, and a retention policy (tool-call histories can contain sensitive data). AWS isn't accepting direct code contributions yet - just language design feedback. The harder question: is your event history complete and trustworthy enough to base authorization decisions on it? What to do - Building agents on Bedrock AgentCore? Dogwood is already available via AgentCore Policy - worth reading the launch post to understand what temporal policies you can now express. - Using Cedar directly? Dogwood is a drop-in extension. Start with one high-stakes sequence - a financial workflow, an approval-gated action - and write a Dogwood policy for it. - Not on AWS? The open-source language spec is the interesting part here. The pattern (stateful sequence policy as a layer outside the LLM) is architecture-agnostic. - Designing agentic systems? The concurrent-transfer problem is a good test: if your agent can fire parallel tool calls, make sure your rate limits account for in-flight requests, not just completed ones. Sources: AWS Blog - Introducing Dogwood · The New Stack ✏️ Drafted with KewBot (AI), edited and approved by Drew. Top comments (0)