AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls

Details

AWS AgentCore Policy, launched at re:Invent 2025, sits outside the LLM as a deterministic enforcement layer: the model proposes a tool call, the policy engine accepts or rejects it. It relied on Cedar, the policy language AWS contributed to CNCF in late 2025, which evaluates one request at a time — stateless by design. Dogwood extends Cedar with a second clause type, 'when temporal', that reads the agent's event history. Four standard-library operators cover the common patterns: 'formerly' (did something happen in a window), 'count_within' (how many times), 'count_distinct_within' (distinct values), and 'sum_within' (running total). Action schemas derive from the agent's MCP tool manifest, so Dogwood can generate policies directly from tool definitions. The announcement includes a sharp correctness warning: policies that sum settled responses rather than requests can be defeated by concurrency — three simultaneous $2,000 transfers arrive before any completes, so the running total sees nothing and all three clear a $5,000 limit. This temporal-ordering trap is exactly what Dogwood is designed to surface. For teams building agentic systems with real compliance exposure — financial workflows, data access chains, multi-step API pipelines — Dogwood provides a formalized vocabulary for constraints that were previously ad-hoc guardrail workarounds. The Apache 2.0 license and existing AgentCore integration make it immediately deployable.