--- title: AWS launches Dogwood, a temporal policy language for AI... description: AWS has released Dogwood, an open-source policy language that extends Cedar to support temporal authorization for AI agent workflows. Unlike standard... canonical: https://daily.dev/posts/aws-launches-dogwood-a-temporal-policy-language-for-ai-agent-authorization-integrated-into-amazon--feevmhp42 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AWS launches Dogwood, a temporal policy language for AI agent authorization, integrated into Amazon Bedrock AgentCore | daily.dev og:description: AWS has released Dogwood, an open-source policy language that extends Cedar to support temporal authorization for AI agent workflows. Unlike standard... og:url: https://daily.dev/posts/aws-launches-dogwood-a-temporal-policy-language-for-ai-agent-authorization-integrated-into-amazon--feevmhp42 og:image: https://api.daily.dev/og/posts/FEevMHP42.png og:image:alt: AWS launches Dogwood, a temporal policy language for AI agent authorization, integrated into Amazon Bedrock AgentCore og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS launches Dogwood, a temporal policy language for AI agent authorization, integrated into Amazon Bedrock AgentCore **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 0 comments ## Summary AWS has released Dogwood, an open-source policy language that extends Cedar to support temporal authorization for AI agent workflows. Unlike standard authorization systems that evaluate requests in isolation, Dogwood can examine an agent's prior tool calls and responses within a session before deciding whether to allow the current action. This enables patterns like workflow sequencing, human approval gates, argument matching, data freshness checks, and aggregate rate limits across concurrent requests. It is backward-compatible with Cedar and available under Apache 2.0, though the reference interpreter is intended for exploration rather than production use. Amazon Bedrock AgentCore also gains rate limiting controls for per-user or per-group limits on request rates, tokens, and concurrent connections scoped via OAuth or AWS IAM. ## Content AWS has released Dogwood, an open-source policy language that extends Cedar to handle authorization for AI agent workflows. It's now integrated into Amazon Bedrock AgentCore alongside a new rate limiting feature. ## The problem Dogwood solves Standard authorization systems evaluate each request in isolation: is this action permitted right now, given the current context? That works fine for most software, but AI agents create a different problem. An agent might make a tool call that's individually valid but wrong given what it already did earlier in the session. The classic example: an agent that can execute stock trades should probably require explicit approval before doing so, even if the trade itself is technically within its permissions. Or consider a transfer limit - if an agent makes five $200 transfers in parallel, a per-request check might approve all five before any of them register against the limit. Cedar, AWS's existing policy language, handles point-in-time decisions well. Dogwood adds temporal conditions that can examine earlier tool requests and responses within a session before deciding whether to allow the current one. ## What Dogwood actually does Dogwood is backward-compatible with Cedar - any valid Cedar policy works as a valid Dogwood policy. The extension adds the ability to write policies that reference prior events in an agent's action history. This enables a few specific patterns: - **Workflow sequencing**: require that step A happened before allowing step B - **Argument matching**: check that the current request's arguments match outputs from a prior tool call - **Human approval gates**: block privileged actions until a human approval event appears in the session history - **Data freshness**: reject requests that rely on stale data from earlier in the session - **Aggregate limits**: enforce hourly or session-level transfer limits even when requests arrive concurrently The reference interpreter is available under Apache 2.0 on GitHub. AWS is explicit that it's intended for exploration and testing, not production use. Teams running it in production would need to handle trusted event histories, tenant isolation, and data retention themselves. ## Rate limiting in AgentCore Alongside Dogwood, Amazon Bedrock AgentCore now includes rate limiting controls for the gateway layer. These let you set per-user or per-group limits on request rates, inference tokens, and concurrent connections across tools, models, and agents. Scoping works through OAuth or AWS IAM, so limits can be tied to specific users or groups rather than applied globally. ## What this looks like in practice The combination addresses something that's been quietly awkward about deploying AI agents: the gap between "this action is permitted" and "this action makes sense given everything the agent has done so far." Rate limiting handles the traffic control side. Dogwood handles the sequencing and context side. The open-source interpreter is available now. The AgentCore integration is live for teams already using Bedrock. ## Questions this post answers ### What is AWS Dogwood and how does it differ from Cedar for AI agent authorization? Dogwood is an open-source policy language released by AWS that extends Cedar to add temporal conditions for AI agent authorization. While Cedar evaluates each request in isolation, Dogwood can examine prior tool calls and responses within a session before approving a current action, enabling checks like requiring step A before step B or enforcing session-level transfer limits. It is backward-compatible, so any valid Cedar policy also works as a Dogwood policy. _Teams designing agent permission systems can follow policy language updates like Dogwood on daily.dev._ ### Is AWS Dogwood ready for production use in AI agent systems? No, AWS states the reference interpreter is intended for exploration and testing, not production. Teams wanting to run it in production would need to build their own handling of trusted event histories, tenant isolation, and data retention, since these are not provided by the reference implementation available under Apache 2.0 on GitHub. _Evaluating whether a new authorization tool is production-ready is easier when tracking releases like this via daily.dev._ ### What rate limiting features does Amazon Bedrock AgentCore support? Amazon Bedrock AgentCore's gateway layer now supports rate limiting controls that let teams set per-user or per-group limits on request rates, inference tokens, and concurrent connections across tools, models, and agents. Scoping is handled through OAuth or AWS IAM, so limits can target specific users or groups instead of applying uniformly across an entire deployment. _Developers tuning AI agent traffic controls can keep tabs on AgentCore changes through daily.dev._ ## Similar posts on daily.dev - [AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls](https://daily.dev/posts/aws-open-sources-dogwood-extending-cedar-to-govern-sequences-of-agent-tool-calls-bxi8df9jv) · InfoQ · 1 upvotes · 0 comments - [Policy in Amazon Bedrock AgentCore is now generally available](https://daily.dev/posts/policy-in-amazon-bedrock-agentcore-is-now-generally-available-b02vtcgbj) · AWS · 1 upvotes · 0 comments - [AWS Weekly Roundup: AWS Heroes Summit, Web Search on Amazon Bedrock, Dogwood, Kiro Crew, and more \(August 10, 2026\)](https://daily.dev/posts/aws-weekly-roundup-aws-heroes-summit-web-search-on-amazon-bedrock-dogwood-kiro-crew-and-more-a-lr841anva) · AWS · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#ai-agents](https://daily.dev/tags/ai-agents), [#authorization](https://daily.dev/tags/authorization), [#amazon-bedrock](https://daily.dev/tags/amazon-bedrock) [View this post on daily.dev](https://daily.dev/posts/aws-launches-dogwood-a-temporal-policy-language-for-ai-agent-authorization-integrated-into-amazon--feevmhp42) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AWS launches Dogwood, a temporal policy language for AI agent authorization, integrated into Amazon Bedrock AgentCore","url":"https://daily.dev/posts/aws-launches-dogwood-a-temporal-policy-language-for-ai-agent-authorization-integrated-into-amazon--feevmhp42","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aws-launches-dogwood-a-temporal-policy-language-for-ai-agent-authorization-integrated-into-amazon--feevmhp42"},"datePublished":"2026-08-06T19:15:48.288Z","dateModified":"2026-09-13T19:22:21.640Z","description":"AWS has released Dogwood, an open-source policy language that extends Cedar to support temporal authorization for AI agent workflows. Unlike standard...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c0030d77203b30918dc36e3a9e9c4018?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c0030d77203b30918dc36e3a9e9c4018?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aws-launches-dogwood-a-temporal-policy-language-for-ai-agent-authorization-integrated-into-amazon--feevmhp42","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,ai-agents,authorization,amazon-bedrock","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"AWS launches Dogwood, a temporal policy language for AI agent authorization, integrated into Amazon Bedrock AgentCore"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aws-launches-dogwood-a-temporal-policy-language-for-ai-agent-authorization-integrated-into-amazon--feevmhp42#faq","mainEntity":[{"@type":"Question","name":"What is AWS Dogwood and how does it differ from Cedar for AI agent authorization?","acceptedAnswer":{"@type":"Answer","text":"Dogwood is an open-source policy language released by AWS that extends Cedar to add temporal conditions for AI agent authorization. While Cedar evaluates each request in isolation, Dogwood can examine prior tool calls and responses within a session before approving a current action, enabling checks like requiring step A before step B or enforcing session-level transfer limits. It is backward-compatible, so any valid Cedar policy also works as a Dogwood policy. Teams designing agent permission systems can follow policy language updates like Dogwood on daily.dev."}},{"@type":"Question","name":"Is AWS Dogwood ready for production use in AI agent systems?","acceptedAnswer":{"@type":"Answer","text":"No, AWS states the reference interpreter is intended for exploration and testing, not production. Teams wanting to run it in production would need to build their own handling of trusted event histories, tenant isolation, and data retention, since these are not provided by the reference implementation available under Apache 2.0 on GitHub. Evaluating whether a new authorization tool is production-ready is easier when tracking releases like this via daily.dev."}},{"@type":"Question","name":"What rate limiting features does Amazon Bedrock AgentCore support?","acceptedAnswer":{"@type":"Answer","text":"Amazon Bedrock AgentCore's gateway layer now supports rate limiting controls that let teams set per-user or per-group limits on request rates, inference tokens, and concurrent connections across tools, models, and agents. Scoping is handled through OAuth or AWS IAM, so limits can target specific users or groups instead of applying uniformly across an entire deployment. Developers tuning AI agent traffic controls can keep tabs on AgentCore changes through daily.dev."}}]} ```