AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls
AWS has open-sourced Dogwood, a policy language extending Cedar with temporal conditions so rules can reason about an agent's prior tool calls rather than one request in isolation. It covers approvals, rate limits and running totals, ships under Apache 2.0, and is supported in AgentCore Policy, though the reference interpreter is not production-ready. By Steef-Jan Wiggers
AWS recently opened sourced Dogwood, a policy language designed to govern sequences of agent tool calls. Unlike Cedar, which can only evaluate actions in isolation, Dogwood can look backward at the agent's past actions. Dogwood uses Apache 2.0 licensing and integrates with AgentCore Policy, first launched at re:Invent last year.
AgentCore Policy operates as a deterministic control layer separate from the model, determining whether model-generated tool calls should be accepted or rejected. Cedar, the language used to write these decisions, is a sandbox project that AWS contributed to the CNCF in late 2025. Cedar processes one request at a time, ensuring consistent outcomes regardless of previous requests or policy execution order.
This characteristic makes Cedar useful for auditing and automated reasoning. However, it cannot describe sequences of actions, which Dogwood addresses. Dogwood introduces temporal conditions that can reference the agent's event history, enabling it to evaluate sequences of actions. These conditions, defined using Metric First-Order Temporal Logic, offer operators such as whether something happened within a time window, the number of times something occurred, the number of distinct values, and a running total.
AWS cautions that temporal evaluation requires stateful event tracking and can suffer from incorrect behavior when actions are executed in parallel, a common issue in distributed systems. To mitigate this, Dogwood's temporal conditions cannot be analyzed automatically like Cedar's can, limiting the potential for formal verification.
Existing Cedar policies remain compatible with Dogwood, eliminating the need for rewriting. However, AWS emphasizes that the reference interpreter is for testing and exploration, not for production authorization. The complete solution requires a trustworthy event log, including trusted timestamps, authenticated events, consistent field and action names, and durable storage for event traces.
AWS plans to enhance Dogwood with absolute-time windows, liveness properties, and orchestration policies for multi-agent systems as it progresses.
Written by urgent.news from InfoQ's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
