--- title: AWS Open-Sources Dogwood, Extending Cedar to Govern... description: AWS has open-sourced Dogwood, a policy language that extends its Cedar authorization language with temporal conditions, letting rules reason about sequences of... canonical: https://daily.dev/posts/aws-open-sources-dogwood-extending-cedar-to-govern-sequences-of-agent-tool-calls-bxi8df9jv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls | daily.dev og:description: AWS has open-sourced Dogwood, a policy language that extends its Cedar authorization language with temporal conditions, letting rules reason about sequences of... og:url: https://daily.dev/posts/aws-open-sources-dogwood-extending-cedar-to-govern-sequences-of-agent-tool-calls-bxi8df9jv og:image: https://api.daily.dev/og/posts/BXI8dF9Jv.png og:image:alt: AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 1 upvotes · 0 comments ## Summary AWS has open-sourced Dogwood, a policy language that extends its Cedar authorization language with temporal conditions, letting rules reason about sequences of an AI agent's prior tool calls rather than a single isolated request. It adds operators like formerly, count_within, count_distinct_within and sum_within to express approvals, rate limits and running totals, and integrates with AgentCore Policy, which launched at re:Invent. Existing Cedar policies remain valid under Dogwood, but temporal conditions sacrifice Cedar's automated formal-reasoning guarantees. AWS highlights a concurrency gotcha where rate limits written against response events rather than request events can be bypassed by parallel tool calls. The reference interpreter, released under Apache 2.0, is explicitly not production-ready. The release coincides with the MCP 2026-07-28 spec adding required method and tool-name headers for agent traffic. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is AWS Dogwood and how is it different from Cedar for agent authorization? Dogwood is an open-source policy language, released under Apache 2.0, that extends Cedar by adding temporal conditions so rules can reason about an agent's prior tool calls rather than evaluating a single request in isolation. It introduces a 'when temporal' clause alongside Cedar's standard 'when' clause, backed by operators like formerly, count_within, count_distinct_within, and sum_within. Existing Cedar policies remain valid Dogwood policies, so nothing needs rewriting. _daily.dev surfaces releases like this for engineers designing authorization for multi-step agent workflows._ ### Why would a rate limit policy for AI agent tool calls fail under concurrency? A rate limit written against response events instead of request events can be defeated when tool calls run concurrently. In AWS's example, three concurrent $2,000 transfers arrive before any settles, so a policy summing responses sees nothing in flight and allows all three past a $5,000 cap, while a policy summing requests correctly denies the third. The fix is a single word: track requests, not responses. _developers hardening agent rate limits can track concurrency pitfalls like this via daily.dev._ ### Is the Dogwood reference interpreter ready for production use? No, AWS states the reference interpreter is intended only for exploring and testing the Dogwood language, not for running authorization in production. Deploying it safely requires trusted and authenticated timestamps, consistent field and action naming, durable trace storage, decision logging, strict per-tenant isolation of event history, and a retention policy for sensitive tool-call data. _teams evaluating agent policy tooling maturity can follow rollout details like this on daily.dev._ ## Similar posts on daily.dev - [AI Agent Authorization Beyond Authentication: A Look At AWS Dogwood](https://daily.dev/posts/ai-agent-authorization-beyond-authentication-a-look-at-aws-dogwood-jwzj35dq1) · Security Boulevard · 1 upvotes · 0 comments - [AWS Weekly Roundup: AWS Heroes Summit, Web Search on Amazon Bedrock, Dogwood, Kiro Crew, and more \(August 10, 2026\)](https://daily.dev/posts/aws-weekly-roundup-aws-heroes-summit-web-search-on-amazon-bedrock-dogwood-kiro-crew-and-more-a-lr841anva) · AWS · 1 upvotes · 0 comments - [Cedar Joins CNCF as a Sandbox Project](https://daily.dev/posts/cedar-joins-cncf-as-a-sandbox-project-appf5vfoi) · InfoQ · 0 upvotes · 0 comments - [All About Cedar, an Open Source Solution for Fine-Tuning Kubernetes Authorization](https://daily.dev/posts/all-about-cedar-an-open-source-solution-for-fine-tuning-kubernetes-authorization-akfpwi21s) · The New Stack · 8 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#ai-agents](https://daily.dev/tags/ai-agents), [#policy-as-code](https://daily.dev/tags/policy-as-code) [View this post on daily.dev](https://daily.dev/posts/aws-open-sources-dogwood-extending-cedar-to-govern-sequences-of-agent-tool-calls-bxi8df9jv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls","url":"https://daily.dev/posts/aws-open-sources-dogwood-extending-cedar-to-govern-sequences-of-agent-tool-calls-bxi8df9jv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aws-open-sources-dogwood-extending-cedar-to-govern-sequences-of-agent-tool-calls-bxi8df9jv"},"datePublished":"2026-08-16T07:44:14.215Z","dateModified":"2026-09-14T07:54:43.497Z","description":"AWS has open-sourced Dogwood, a policy language that extends its Cedar authorization language with temporal conditions, letting rules reason about sequences of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c255731ee03d90dbd8adb1747ed0570d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c255731ee03d90dbd8adb1747ed0570d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aws-open-sources-dogwood-extending-cedar-to-govern-sequences-of-agent-tool-calls-bxi8df9jv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,ai-agents,policy-as-code","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aws-open-sources-dogwood-extending-cedar-to-govern-sequences-of-agent-tool-calls-bxi8df9jv#faq","mainEntity":[{"@type":"Question","name":"What is AWS Dogwood and how is it different from Cedar for agent authorization?","acceptedAnswer":{"@type":"Answer","text":"Dogwood is an open-source policy language, released under Apache 2.0, that extends Cedar by adding temporal conditions so rules can reason about an agent's prior tool calls rather than evaluating a single request in isolation. It introduces a 'when temporal' clause alongside Cedar's standard 'when' clause, backed by operators like formerly, count_within, count_distinct_within, and sum_within. Existing Cedar policies remain valid Dogwood policies, so nothing needs rewriting. daily.dev surfaces releases like this for engineers designing authorization for multi-step agent workflows."}},{"@type":"Question","name":"Why would a rate limit policy for AI agent tool calls fail under concurrency?","acceptedAnswer":{"@type":"Answer","text":"A rate limit written against response events instead of request events can be defeated when tool calls run concurrently. In AWS's example, three concurrent $2,000 transfers arrive before any settles, so a policy summing responses sees nothing in flight and allows all three past a $5,000 cap, while a policy summing requests correctly denies the third. The fix is a single word: track requests, not responses. developers hardening agent rate limits can track concurrency pitfalls like this via daily.dev."}},{"@type":"Question","name":"Is the Dogwood reference interpreter ready for production use?","acceptedAnswer":{"@type":"Answer","text":"No, AWS states the reference interpreter is intended only for exploring and testing the Dogwood language, not for running authorization in production. Deploying it safely requires trusted and authenticated timestamps, consistent field and action naming, durable trace storage, decision logging, strict per-tenant isolation of event history, and a retention policy for sensitive tool-call data. teams evaluating agent policy tooling maturity can follow rollout details like this on daily.dev."}}]} ```