1d:I[70616,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"Breadcrumb"] 1e:I[90762,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"ArticleGrid"] 1f:Tf43,

AWS has released Dogwood, an open-source policy language and reference interpreter designed to govern sequences of AI agent tool calls rather than evaluating each action on its own. The language and its implementation are available under the Apache 2.0 license, with the reference parser and interpreter published on GitHub.

The release targets a gap that has become increasingly visible as agents move into production. Conventional authorization systems answer a single question: is this actor permitted to perform this action right now? That framing works well for traditional access control, but it misses a category of failure specific to agents.

Valid but Wrong

An agent can make a tool call that is entirely permissible in isolation yet clearly wrong in context. Issuing a refund is a legitimate operation. Issuing a refund before verifying the order exists is not. Querying a database is fine; querying it four hundred times in a minute is a runaway loop. Every individual call passes a point-in-time check, and the workflow still goes wrong.

AWS framed the problem in terms of composition. Point-in-time decisions make sense for many forms of access control, but once agents chain multiple actions into longer workflows, the sequence itself becomes the thing teams want to govern. Dogwood is intended to give them a vocabulary for expressing constraints over those sequences, covering prerequisites, rate limits and ordering.

Cedar, Extended Through Time

Dogwood builds on Cedar, the open-source authorization language AWS released previously and which already underpins Amazon Bedrock AgentCore Policy. The extension adds temporal conditions that reference the history of prior events, alongside rules for approvals, ordering and running limits.

That history-awareness is the core departure. A Dogwood policy can require that an agent call tools in a specific order, stop using certain tools once others have run, or cap how often a given tool may be invoked within a window. None of those constraints are expressible in a language that only sees the current request.

Critically, Dogwood is compatible with existing Cedar policies. AWS says customers can keep their current rules in place with no migration required, which lowers the cost of experimentation considerably for teams already invested in Cedar.

Managed Service Support

Alongside the open-source release, AWS added Dogwood support to Amazon Bedrock AgentCore Policy, its managed service for controlling which tools an agent may call and under what conditions. That gives the language two adoption paths: self-hosted through the reference interpreter, or consumed as part of the managed AWS stack.

The dual release is a familiar pattern for AWS, and a pragmatic one. Publishing the specification and interpreter under a permissive license invites adoption outside the AWS ecosystem and positions Dogwood as a candidate standard, while the AgentCore integration gives existing customers a path that requires no infrastructure work.

The Governance Gap

Agent governance has lagged well behind agent capability. Development effort has concentrated on making agents more capable at planning and executing multi-step tasks, while the tooling for constraining that execution has remained thin. Most production deployments today rely on prompt-level instructions and hand-rolled wrapper code, neither of which offers auditable guarantees.

A declarative policy language changes that calculus. Rules become inspectable artifacts that security teams can review independently of application code, and enforcement moves out of the model's instruction-following behavior into a deterministic interpreter. For regulated environments in particular, that separation is the difference between an agent deployment that can be signed off and one that cannot.

a:["$","div",null,{"className":"mx-auto max-w-7xl px-4 py-8 sm:px-6","children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https://ainewsway.com\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"#cedar\",\"item\":\"https://ainewsway.com/tag/cedar\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"ItemList\",\"@id\":\"https://ainewsway.com/tag/cedar#itemlist\",\"name\":\"#cedar Articles\",\"numberOfItems\":1,\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"url\":\"https://ainewsway.com/articles/aws-open-sources-dogwood-a-policy-language-for-governing-agent-tool-call-sequences-msi90fr5\",\"name\":\"AWS Open-Sources Dogwood, a Policy Language for Governing Agent Tool Call Sequences\"}]}"}}],["$","$L1d",null,{"items":[{"label":"# cedar"}]}],["$","h1",null,{"className":"mb-8 text-3xl font-bold text-zinc-900 dark:text-zinc-100","children":["#","cedar"]}],[["$","$L1e",null,{"articles":[{"id":"170a53be-0e51-4f72-8516-50f160542613","slug":"aws-open-sources-dogwood-a-policy-language-for-governing-agent-tool-call-sequences-msi90fr5","title":"AWS Open-Sources Dogwood, a Policy Language for Governing Agent Tool Call Sequences","subtitle":"Built on Cedar and released under Apache 2.0, Dogwood lets teams write rules about what an agent has already done, not just what it is doing now","content":"$1f","excerpt":"AWS released Dogwood under Apache 2.0, an open-source policy language that governs sequences of AI agent tool calls using history-aware rules.","coverImage":"https://cdn.ainewsway.com/processed/v1/16ef623c-fe42-4a90-897d-0d9f710d651d/cover.webp","coverImageCaption":"The Amazon Web Services logo, marking the cloud provider that released the Dogwood agent policy language as open source","authorId":"6773f67d-d7fa-4b19-8f38-384f10ac761b","status":"PUBLISHED","publishedAt":"2026-08-07T01:11:49.115Z","viewCount":94,"likeCount":0,"readingTime":3,"isFeatured":false,"isBreakingNews":false,"metaTitle":"AWS Open-Sources Dogwood to Govern AI Agent Actions","metaDescription":"AWS released Dogwood, an open-source policy language built on Cedar that governs sequences of AI agent tool calls, not just single actions.","metaKeywords":["AWS","Dogwood","Cedar","AI agents","Amazon Bedrock","open source","agent governance","developer tools"],"ogImage":"https://cdn.ainewsway.com/processed/v1/16ef623c-fe42-4a90-897d-0d9f710d651d/og.jpg","aiSummary":"AWS open-sourced Dogwood, a policy language and reference interpreter under Apache 2.0 that governs sequences of AI agent tool calls rather than evaluating each action alone, addressing failures like refunds issued before order verification or runaway repeated queries. Built as an extension of AWS's Cedar authorization language, Dogwood adds temporal conditions referencing prior events, letting teams require specific call ordering, approvals and rate limits, while staying compatible with existing Cedar policies. It is also available through Amazon Bedrock AgentCore Policy.","aiTags":[],"sentiment":null,"articleType":"NEWS","videoEmbed":null,"videoType":null,"seoScore":85,"isAutoGenerated":true,"isBackfill":false,"pipelineStage":null,"copyrightScore":null,"similarityScore":null,"matchedSourceId":null,"createdAt":"2026-08-07T01:10:43.650Z","updatedAt":"2026-09-10T01:44:32.200Z","contentUpdatedAt":"2026-08-07T01:11:49.115Z","deletedAt":null,"author":{"id":"6773f67d-d7fa-4b19-8f38-384f10ac761b","name":"Seung Jung","username":"Seung Jung","avatar":null},"categories":[{"id":"32f2303b-b593-473f-bf9c-6a99acbe6ce1","name":"Developer Tools","slug":"developer-tools"}],"tags":[{"id":"14b4b51e-9f9f-4cbe-9bcc-4af604b639eb","name":"AWS","slug":"aws"},{"id":"971d527f-0508-47c9-aac1-39914a5f883c","name":"AI Agents","slug":"ai-agents"},{"id":"dbb28dbd-4512-4daa-9191-85e040c30141","name":"Open Source","slug":"open-source"},{"id":"75b2c84c-e9a7-4365-9125-c2ed4fe7ebc6","name":"Cedar","slug":"cedar"},{"id":"6853cbcb-c672-4532-8d68-3621dec95db8","name":"Amazon Bedrock","slug":"amazon-bedrock"}],"translations":[],"celebrities":[{"id":"647b0f38-dc05-4b8c-9326-eedd91c3f3cb","nameKo":"아마존 웹 서비스","nameEn":"Amazon Web Services","slug":"amazon-web-services","profileImage":null}]}]}],"$L20"]]}]

#cedar

AWS Open-Sources Dogwood, a Policy Language for Governing Agent Tool Call Sequences

Subscribe to Newsletter

#cedar

AWS Open-Sources Dogwood, a Policy Language for Governing Agent Tool Call Sequences