--- title: AI Agent Authorization Beyond Authentication: A Look At... description: AWS Dogwood, an open-source governance language released in August 2026, extends the Cedar policy language with temporal policy evaluation for AI agents,... canonical: https://daily.dev/posts/ai-agent-authorization-beyond-authentication-a-look-at-aws-dogwood-jwzj35dq1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI Agent Authorization Beyond Authentication: A Look At AWS Dogwood | daily.dev og:description: AWS Dogwood, an open-source governance language released in August 2026, extends the Cedar policy language with temporal policy evaluation for AI agents,... og:url: https://daily.dev/posts/ai-agent-authorization-beyond-authentication-a-look-at-aws-dogwood-jwzj35dq1 og:image: https://api.daily.dev/og/posts/jWzJ35dq1.png og:image:alt: AI Agent Authorization Beyond Authentication: A Look At AWS Dogwood og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI Agent Authorization Beyond Authentication: A Look At AWS Dogwood **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 14 min read · 1 upvotes · 0 comments ## Summary AWS Dogwood, an open-source governance language released in August 2026, extends the Cedar policy language with temporal policy evaluation for AI agents, allowing authorization decisions to consider sequences of prior actions rather than just point-in-time requests. This addresses risks like the 'lethal trifecta' (an agent reading sensitive data and then sending it externally), which point-in-time authorization can't catch. The piece situates Dogwood alongside AuthZEN (finalized January 2026), OAuth, OIDC, and SPIFFE/SPIRE as part of a broader IAM modernization trend, while arguing that legacy long-lived credentials remain a major risk — GitGuardian found 28.65 million hardcoded secrets in public GitHub commits in 2025, with AI-related leaks up 81%. GitGuardian's Secret Analyzer and Exploration Map are presented as tools to map credential permissions and dependencies during migration to workload identity and runtime authorization. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is AWS Dogwood and how does it differ from Cedar? AWS Dogwood is an open-source governance language for AI agents and their tools, introduced in August 2026. It builds on the Cedar policy language by adding temporal conditions that evaluate sequences of prior actions and their outcomes alongside the current request, rather than authorizing each request in isolation as Cedar does. _Explore how daily.dev surfaces emerging AI agent authorization tooling like Dogwood for security teams._ ### What is the lethal trifecta in AI agent security? The lethal trifecta, a term coined by security researcher Simon Willison, describes an agent that can read sensitive data, has access to untrusted content, and can send information to an external system. Any one capability may be safe alone, but reading sensitive information and then sending it externally creates a dangerous outcome that point-in-time authorization checks fail to catch. _Developers securing agent workflows can follow lethal-trifecta mitigations and related research via daily.dev._ ### How does AWS Dogwood relate to the AuthZEN Authorization API standard? Dogwood and AuthZEN are complementary rather than competing. AuthZEN, finalized by the OpenID Foundation as version 1.0 in January 2026, standardizes how an authorization request reaches a policy decision point. Dogwood strengthens what that decision point can evaluate by adding the agent's recent action history to the current request, addressing sequence-dependent authorization decisions that AuthZEN alone doesn't define. _Teams comparing authorization standards for agentic systems can track AuthZEN and Dogwood developments on daily.dev._ ## Similar posts on daily.dev - [Agentic AI Security Comes Down to Access, Not the Trick](https://daily.dev/posts/agentic-ai-security-comes-down-to-access-not-the-trick-q9sdq1e4s) · GitGuardian · 0 upvotes · 0 comments - [AI agent authorization risks remain a gap in new NIST-CISA token security guidance](https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus) · CSO Online · 0 upvotes · 0 comments - [Docker AI Governance: Unlock Agent Autonomy, Safely](https://daily.dev/posts/docker-ai-governance-unlock-agent-autonomy-safely-s3gotzrnq) · Docker · 2 upvotes · 0 comments - [Your Kubernetes RBAC Was Not Built for AI Agents. Here’s Exactly Where It Breaks](https://daily.dev/posts/your-kubernetes-rbac-was-not-built-for-ai-agents-here-s-exactly-where-it-breaks-djvoyoewy) · Medium · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#ai-agents](https://daily.dev/tags/ai-agents), [#authorization](https://daily.dev/tags/authorization), [#secrets-management](https://daily.dev/tags/secrets-management), [#gitguardian](https://daily.dev/tags/gitguardian) [View this post on daily.dev](https://daily.dev/posts/ai-agent-authorization-beyond-authentication-a-look-at-aws-dogwood-jwzj35dq1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI Agent Authorization Beyond Authentication: A Look At AWS Dogwood","url":"https://daily.dev/posts/ai-agent-authorization-beyond-authentication-a-look-at-aws-dogwood-jwzj35dq1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-agent-authorization-beyond-authentication-a-look-at-aws-dogwood-jwzj35dq1"},"datePublished":"2026-09-30T15:09:32.642Z","dateModified":"2026-09-30T15:09:58.458Z","description":"AWS Dogwood, an open-source governance language released in August 2026, extends the Cedar policy language with temporal policy evaluation for AI agents,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0ccc8fc40c9c2de3ea3dfb68d0eb367e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0ccc8fc40c9c2de3ea3dfb68d0eb367e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-agent-authorization-beyond-authentication-a-look-at-aws-dogwood-jwzj35dq1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,ai-agents,authorization,secrets-management,gitguardian","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"AI Agent Authorization Beyond Authentication: A Look At AWS Dogwood"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-agent-authorization-beyond-authentication-a-look-at-aws-dogwood-jwzj35dq1#faq","mainEntity":[{"@type":"Question","name":"What is AWS Dogwood and how does it differ from Cedar?","acceptedAnswer":{"@type":"Answer","text":"AWS Dogwood is an open-source governance language for AI agents and their tools, introduced in August 2026. It builds on the Cedar policy language by adding temporal conditions that evaluate sequences of prior actions and their outcomes alongside the current request, rather than authorizing each request in isolation as Cedar does. Explore how daily.dev surfaces emerging AI agent authorization tooling like Dogwood for security teams."}},{"@type":"Question","name":"What is the lethal trifecta in AI agent security?","acceptedAnswer":{"@type":"Answer","text":"The lethal trifecta, a term coined by security researcher Simon Willison, describes an agent that can read sensitive data, has access to untrusted content, and can send information to an external system. Any one capability may be safe alone, but reading sensitive information and then sending it externally creates a dangerous outcome that point-in-time authorization checks fail to catch. Developers securing agent workflows can follow lethal-trifecta mitigations and related research via daily.dev."}},{"@type":"Question","name":"How does AWS Dogwood relate to the AuthZEN Authorization API standard?","acceptedAnswer":{"@type":"Answer","text":"Dogwood and AuthZEN are complementary rather than competing. AuthZEN, finalized by the OpenID Foundation as version 1.0 in January 2026, standardizes how an authorization request reaches a policy decision point. Dogwood strengthens what that decision point can evaluate by adding the agent's recent action history to the current request, addressing sequence-dependent authorization decisions that AuthZEN alone doesn't define. Teams comparing authorization standards for agentic systems can track AuthZEN and Dogwood developments on daily.dev."}}]} ```