AWS Open-Sources Dogwood to Govern AI Agent Tool Calls

AWS has released Dogwood under the Apache 2.0 license, providing a policy language designed to govern sequences of AI agent tool calls. While the existing Cedar language—which AWS contributed to the Cloud Native Computing Foundation in late 2025—evaluates requests individually, Dogwood introduces temporal conditions. This allows the system to analyze an agent's historical actions before permitting a new tool call. Currently supported by AgentCore Policy, Dogwood helps developers enforce complex workflows, such as requiring approvals before taking actions or capping cumulative spending.

Dogwood introduces a temporal clause that reads an agent's event history, which is generated directly from the Model Context Protocol tool manifest. The language includes four standard-library macros built over a Metric First-Order Temporal Logic subset: formerly, count_within, count_distinct_within, and sum_within. It also features a bind operator to compare current requests against historical aggregates. However, AWS warns of potential concurrency traps. For example, if a policy sums response events instead of request events, three concurrent $2,000 transfers could bypass a $5,000 limit because the in-flight transactions have not yet settled.

For practitioners, adopting Dogwood involves clear trade-offs. While any valid Cedar policy remains valid in Dogwood, temporal evaluation requires stateful event tracking, and evaluation times scale with the length of the event log. Additionally, Dogwood policies cannot use the automated reasoning analysis tools available in Cedar. AWS emphasizes that the current reference interpreter is meant for testing rather than production. To deploy it safely, teams must build a highly secure event log with trusted timestamps, authenticated events, durable storage, and strict multi-tenant isolation.

The release of Dogwood coincided with the MCP 2026-07-28 specification, which standardizes agent traffic headers. Co-authored by AWS executives Marc Brooker, Joseph Tassarotti, and Jean-Baptiste Tristan, Dogwood's roadmap includes absolute-time windows, liveness properties, and multi-agent orchestration policies. AWS is not currently accepting external contributions as it refines the language.