AWS has released Dogwood, an open-source policy language and reference interpreter designed to govern sequences of AI agent tool calls rather than evaluating each action on its own. The language and its implementation are available under the Apache 2.0 license, with the reference parser and interpreter published on GitHub.
The release targets a gap that has become increasingly visible as agents move into production. Conventional authorization systems answer a single question: is this actor permitted to perform this action right now? That framing works well for traditional access control, but it misses a category of failure specific to agents.
Valid but Wrong
An agent can make a tool call that is entirely permissible in isolation yet clearly wrong in context. Issuing a refund is a legitimate operation. Issuing a refund before verifying the order exists is not. Querying a database is fine; querying it four hundred times in a minute is a runaway loop. Every individual call passes a point-in-time check, and the workflow still goes wrong.
AWS framed the problem in terms of composition. Point-in-time decisions make sense for many forms of access control, but once agents chain multiple actions into longer workflows, the sequence itself becomes the thing teams want to govern. Dogwood is intended to give them a vocabulary for expressing constraints over those sequences, covering prerequisites, rate limits and ordering.
Cedar, Extended Through Time
Dogwood builds on Cedar, the open-source authorization language AWS released previously and which already underpins Amazon Bedrock AgentCore Policy. The extension adds temporal conditions that reference the history of prior events, alongside rules for approvals, ordering and running limits.
That history-awareness is the core departure. A Dogwood policy can require that an agent call tools in a specific order, stop using certain tools once others have run, or cap how often a given tool may be invoked within a window. None of those constraints are expressible in a language that only sees the current request.
Critically, Dogwood is compatible with existing Cedar policies. AWS says customers can keep their current rules in place with no migration required, which lowers the cost of experimentation considerably for teams already invested in Cedar.
Managed Service Support
Alongside the open-source release, AWS added Dogwood support to Amazon Bedrock AgentCore Policy, its managed service for controlling which tools an agent may call and under what conditions. That gives the language two adoption paths: self-hosted through the reference interpreter, or consumed as part of the managed AWS stack.
The dual release is a familiar pattern for AWS, and a pragmatic one. Publishing the specification and interpreter under a permissive license invites adoption outside the AWS ecosystem and positions Dogwood as a candidate standard, while the AgentCore integration gives existing customers a path that requires no infrastructure work.
The Governance Gap
Agent governance has lagged well behind agent capability. Development effort has concentrated on making agents more capable at planning and executing multi-step tasks, while the tooling for constraining that execution has remained thin. Most production deployments today rely on prompt-level instructions and hand-rolled wrapper code, neither of which offers auditable guarantees.
A declarative policy language changes that calculus. Rules become inspectable artifacts that security teams can review independently of application code, and enforcement moves out of the model's instruction-following behavior into a deterministic interpreter. For regulated environments in particular, that separation is the difference between an agent deployment that can be signed off and one that cannot.
