Amazon Web Services on Thursday introduced Dogwood, an open-source policy language that allows developers to control sequences of AI agent tool calls rather than assessing each action separately. The company simultaneously rolled out Dogwood compatibility for Amazon Bedrock AgentCore Policy, its managed service that determines which tools an agent can access and under what circumstances. Both the language and its reference implementation are now accessible under the Apache 2.0 license.
Dogwood expands on Cedar, the open-source authorization language that already drives AgentCore Policy and which AWS contributed to the CNCF as a sandbox project in late 2025. While Cedar can determine whether a user or agent may invoke a refund tool with specific arguments, Dogwood goes further by considering prior events in its decision-making. This includes whether someone previously approved the refund, how much the agent has refunded within the past hour, or whether it earlier retrieved information that should block it from reaching an external service. The language supports checking whether an event took place, counting calls within a time window, tallying distinct values like payment recipients, or summing values such as total amounts transferred. These operations rest on a subset of Metric First-Order Temporal Logic, a formal framework for describing properties of events across time.
According to the AWS team, "Point-in-time decisions make sense for many forms of access control, but when agents compose multiple actions into longer workflows, the sequence itself becomes something teams want to govern." The report explains that Dogwood provides them a language for expressing policies over sequences, capturing constraints on prerequisites, rate limits, and ordering. AWS notes that any existing Cedar policy remains a valid Dogwood policy, so organizations don't need to rewrite their current rules. For temporal policies, Dogwood converts the history-dependent condition into a Cedar context field, which the reference implementation populates from the event history before Cedar renders the authorization verdict.
AWS illustrates how this functions using a stock-trading agent example: a policy can permit the agent to sell shares only if an approval tool returned a positive response for the identical stock and share count during the prior hour, with that approval being a distinct event the policy engine must locate in the agent's recent activity. The language also addresses parallel tool calls—if an agent is restricted from transferring more than $5,000 per hour and the policy only totals completed transfers, the agent could submit multiple $2,000 requests before the first one completes, surpassing its limit because the finished total might still be zero when each request is evaluated. Dogwood has the context and can tally all transfer requests, including those currently under review, causing the third $2,000 request to be rejected even if the first two haven't returned results. However, the report cautions that Dogwood is costlier to operate than Cedar because it's stateful, requiring retention and searching of event records, with evaluation time potentially dependent on history length. The included open-source reference interpreter is intended for exploring and testing the language, not for production authorization use, and teams adopting it would need to supply trusted timestamps, authenticate events, maintain consistent field and action names, store traces durably, log authorization decisions, and isolate histories between tenants.
Looking ahead, AWS plans to introduce rules tied to absolute times, such as quotas that reset at midnight, along with "liveness" properties that verify whether an expected action eventually occurs. The company also aims to extend Dogwood from individual agents to multi-agent systems, where a policy might need to govern handoffs and shared locks. As of now, AWS isn't accepting direct contributions but welcomes community feedback on the language design and future directions. The report emphasizes that for teams using the open-source release, the harder question is whether the event history is complete and trustworthy enough to use for authorization—a foundational requirement for temporal policy enforcement. Organizations managing agentic workflows face a fundamental architectural choice between simple stateless gates and history-aware governance, each carrying distinct operational overhead and security assurances. The decision hinges less on technical capability than on whether the risk profile of agent actions justifies the complexity of tracking every prior move.