AWS has launched Dogwood, an open-source policy language and reference interpreter that extends Cedar to govern sequences of AI agent tool calls rather than evaluating each action in isolation. While Cedar handles point-in-time authorization decisions, Dogwood adds temporal conditions that examine earlier tool requests and responses, enabling policies like requiring prior approval before a stock trade or enforcing hourly transfer limits even across concurrent parallel requests. Dogwood is backward-compatible with Cedar — any valid Cedar policy is also a valid Dogwood policy. It is now available under Apache 2.0 and integrated into Amazon Bedrock AgentCore Policy. The open-source reference interpreter is currently intended for exploration and testing only, not production use, and requires teams to manage trusted event histories, tenant isolation, and data retention.
Table of contents
From one tool call to a sequenceConcurrent tool calls complicate simple limitsDogwood needs a reliable event historyQuestions this post answers
What is AWS Dogwood and how does it differ from Cedar for AI agent authorization?
Dogwood is an open-source policy language that extends Cedar with temporal conditions, allowing policies to govern sequences of AI agent tool calls rather than evaluating each action in isolation. Cedar makes stateless point-in-time decisions; Dogwood can inspect earlier events, count calls within time windows, check prior approvals, and enforce ordering constraints. Any valid Cedar policy is also a valid Dogwood policy, so existing rules do not need to be rewritten. Teams governing AI agents in production track policy tooling like Dogwood on daily.dev as the space moves fast.
How does Dogwood handle concurrent parallel tool calls when enforcing rate limits for AI agents?
Dogwood counts all in-flight transfer requests, not just completed ones. In AWS's example, an agent restricted to $5,000 per hour could otherwise submit multiple $2,000 requests simultaneously before any complete, since the completed total would still be zero at evaluation time. Dogwood includes currently-evaluated requests in its count, so the third $2,000 request is denied even before the first two return results. Developers building multi-step agent workflows with spending limits find edge cases like this covered on daily.dev.
Is the AWS Dogwood open-source reference interpreter ready for production use?
No. The included open-source reference interpreter is intended for exploring and testing the language only. For production use, teams would need to provide trusted timestamps, authenticate events, maintain consistent field and action names, store traces durably, log authorization decisions, isolate histories between tenants, and implement a retention policy for sensitive tool-call history data. Engineers evaluating Dogwood for production agent governance can follow its development and community feedback on daily.dev.