Your AI agent’s next tool call may be valid but wrong. AWS’s Dogwood promises to fix that.

AWS has recently introduced Dogwood, an open-source policy language and reference interpreter designed to govern sequences of AI agent tool calls, rather than evaluating each action independently. This new tool builds upon AWS's existing Cedar authorization language, which powers Amazon Bedrock AgentCore Policy, a managed service that controls tool calls for AI agents based on certain conditions.

Cedar, which AWS contributed to the Cloud Native Computing Foundation (CNCF) as a sandbox project in late 2025, allows for point-in-time decisions based on factors such as approvals, refund amounts, and previous tool accesses.

The primary advantage of Dogwood lies in its ability to consider earlier events when making decisions, providing a more comprehensive approach to access control in longer AI workflows. For instance, in a stock-trading scenario, a policy can only allow a sale if a prior approval event occurred within the previous hour. Dogwood extends this capability by allowing developers to check for event occurrences, count calls within time windows, track distinct values, and aggregate transferred amounts.

However, the introduction of temporal conditions also brings complexity, particularly when dealing with parallel tool calls. AWS provides an example where an agent is restricted to transferring no more than $5,000 per hour. If the policy only sums completed transfers, an agent could submit multiple $2,000 requests before the first transfer completes, exceeding the limit due to the zero total when each check is made.

Dogwood addresses this by accounting for all transfer requests, including those currently being evaluated, preventing the agent from exceeding its limit.

Despite its advantages, Dogwood is more resource-intensive than Cedar due to its stateful nature, requiring the retention and search of event records. Currently, the reference interpreter is intended for exploration and testing purposes rather than production use. However, AWS plans to enhance Dogwood with additional features like rules tied to absolute times, improving its capabilities in the future. For teams transitioning to Dogwood, existing Cedar policies remain valid, minimizing the need for extensive rewrites.