SECURITY Signal 444
AWS open-sources Dogwood policy language to govern sequences of agent tool calls with temporal rules
↗
AWS released Dogwood under Apache 2.0, extending Cedar with temporal conditions that evaluate an agent’s prior tool calls rather than isolated requests.
Engineers building agent-based systems now have a declarative way to enforce approvals, rate limits, and running totals across sequences of actions. The trade-off is that temporal conditions lose Cedar’s automated reasoning guarantees and require durable, trusted event logs. Teams must decide whether the expressive gain justifies the operational cost.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Dogwood adds temporal clauses to Cedar so policies can reason about an agent’s prior tool calls, not just the current request.
Temporal evaluation requires stateful event tracking and forfeits Cedar’s automated reasoning tools, creating a correctness-operational cost trade-off.
Existing Cedar policies remain valid in Dogwood, but production use demands a trusted, durable event log with strict tenant isolation.
THE READ
What the cluster adds up to.
AWS open-sourced Dogwood, a policy language that extends Cedar with temporal conditions. Cedar evaluates each request in isolation; Dogwood can look backward at an agent’s event history. This lets teams write rules that govern sequences of actions, approvals, rate limits, running totals, rather than single requests. The language ships under Apache 2.0 and is supported in AgentCore Policy today.
The temporal extension comes at a cost. Cedar’s automated reasoning tools do not work with temporal conditions, so policies using them cannot be formally analyzed. Evaluation also becomes stateful: the interpreter must track and store events, and evaluation time can grow with the length of the event log. AWS built Dogwood as a separate language rather than extending Cedar to preserve Cedar’s reasoning guarantees for non-temporal policies.
Dogwood’s operators, formerly, count_within, count_distinct_within, sum_within, are defined as macros over a core temporal logic. They let policies express common constraints like “no more than three transfers in an hour” or “sum of transfers must stay under $5,000.” The bind operator names aggregates so the current request can be compared against them. AWS highlights a correctness trap: rate limits must be written against request events, not response events, to handle concurrency.
Concurrency is inherent in agent systems. Agents issue parallel tool calls, and multi-agent settings compound the interleaving. A policy that reads correctly in sequence can fail under concurrency, a familiar distributed systems problem now appearing in authorization. Dogwood’s temporal conditions surface this risk explicitly, forcing teams to consider event ordering and concurrency when writing rules.
Existing Cedar policies remain valid in Dogwood, so teams can adopt temporal conditions incrementally. However, production use demands more than the reference interpreter. Events must be authenticated, timestamps trusted, and field names consistent. Traces need durable storage, decisions need logging, and tenant histories must be strictly isolated. Retention policies matter too, since tool-call histories hold sensitive data. The operational burden is building an event log you can trust.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER