Agentic AI
AWS releases Dogwood to govern sequences of AI agent actions beyond isolated tool calls
The new policy language extends Cedar to let teams enforce rules across multiple steps of an AI agent's workflow—catching risky patterns that individual approvals might miss.
The New Stack
AWS has released Dogwood, an open-source policy framework designed to enforce rules across chains of AI agent actions rather than evaluating each tool call in isolation. The technology extends Cedar, AWS's authorization language, and is now integrated into Amazon Bedrock AgentCore Policy.
The limits of point-in-time decisions#
Traditional authorization systems like Cedar assess whether a single request should proceed by checking the user, the action, the resource, and input parameters in that moment. But when AI agents orchestrate multi-step workflows, a single tool call that appears safe in isolation can become problematic when considered as part of a sequence.
For example, Cedar could approve a refund request if the user has the right role. But it can't check whether the agent already refunded the same customer earlier that day, or whether an approval was actually granted before the refund was requested. As AWS puts it, "point-in-time decisions make sense for many forms of access control, but when agents compose multiple actions into longer workflows, the sequence itself becomes something teams want to govern."
How Dogwood examines sequences#
Dogwood adds temporal conditions that inspect earlier tool calls and their results. A policy can now require that a stock-sale action only succeeds if an approval tool verified it within the previous hour. The language, built on Metric First-Order Temporal Logic, lets developers count events within time windows, track distinct values, and sum totals—all from the agent's recent action history.
Backward compatibility is built in: any existing Cedar policy remains valid in Dogwood, so teams don't need to rewrite current rules.
Handling concurrent requests#
A particular challenge arises when agents submit multiple requests simultaneously. Imagine a transfer limit of $5,000 per hour. If the policy only counts completed transfers, an agent could submit five $2,000 requests before the first one finishes—each would look valid individually, yet collectively they'd exceed the limit. Dogwood can count all pending requests, including those currently being evaluated, catching this overrun before it happens.
