{
  "id": 232875,
  "title": "Your AI agent’s next tool call may be valid but wrong. AWS’s Dogwood promises to fix that.",
  "url": "https://urgent.news/2026/08/06/your-ai-agents-next-tool-call-may-be-valid-but-wrong-awss-dogwood",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-06T19:11:55.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/aws-dogwood-agent-policies/"
  },
  "original_language": "en",
  "account": "AWS has recently introduced Dogwood, an open-source policy language and reference interpreter designed to govern sequences of AI agent tool calls, rather than evaluating each action independently. This new tool builds upon AWS's existing Cedar authorization language, which powers Amazon Bedrock AgentCore Policy, a managed service that controls tool calls for AI agents based on certain conditions. Cedar, which AWS contributed to the Cloud Native Computing Foundation (CNCF) as a sandbox project in late 2025, allows for point-in-time decisions based on factors such as approvals, refund amounts, and previous tool accesses.\n\nThe primary advantage of Dogwood lies in its ability to consider earlier events when making decisions, providing a more comprehensive approach to access control in longer AI workflows. For instance, in a stock-trading scenario, a policy can only allow a sale if a prior approval event occurred within the previous hour. Dogwood extends this capability by allowing developers to check for event occurrences, count calls within time windows, track distinct values, and aggregate transferred amounts.\n\nHowever, the introduction of temporal conditions also brings complexity, particularly when dealing with parallel tool calls. AWS provides an example where an agent is restricted to transferring no more than $5,000 per hour. If the policy only sums completed transfers, an agent could submit multiple $2,000 requests before the first transfer completes, exceeding the limit due to the zero total when each check is made. Dogwood addresses this by accounting for all transfer requests, including those currently being evaluated, preventing the agent from exceeding its limit.\n\nDespite its advantages, Dogwood is more resource-intensive than Cedar due to its stateful nature, requiring the retention and search of event records. Currently, the reference interpreter is intended for exploration and testing purposes rather than production use. However, AWS plans to enhance Dogwood with additional features like rules tied to absolute times, improving its capabilities in the future. For teams transitioning to Dogwood, existing Cedar policies remain valid, minimizing the need for extensive rewrites.",
  "summary": "AWS on Thursday launched Dogwood, an open-source policy language and reference interpreter that lets developers govern sequences of AI agent The post Your AI agent’s next tool call may be valid but wrong. AWS’s Dogwood promises to fix that. appeared first on The New Stack .",
  "key_points": [
    "AWS introduces Dogwood, open-source policy language for AI agent tool calls.",
    "Dogwood builds on Cedar authorization language, adds temporal conditions.",
    "Dogwood addresses parallel tool call limitations, more resource-intensive."
  ],
  "editors_take": "AWS's Dogwood enhances access control for AI agent workflows by considering prior events, allowing more nuanced decisions, but its stateful nature makes it more resource-intensive than its predecessor, Cedar.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}