AWS open-sources Dogwood, a temporal policy language for governing AI agents

AWS has open-sourced Dogwood, a new policy language for governing what AI agents are allowed to do when they call tools. It builds on Cedar, the authorization language already used inside Amazon Bedrock AgentCore Policy, but adds something Cedar can't do on its own: reasoning about sequences of past actions rather than just the current request in isolation. With Dogwood, a policy can require that an action only proceeds after a matching approval was granted within the last hour, cap how many times a tool fires in a window, or block a single transfer larger than everything already settled that hour. Because any valid Cedar policy is also valid Dogwood, existing rules carry over with no rewrite. The language is grounded in metric first-order temporal logic, the same formal-methods lineage as runtime verification, which gives it precise, analyzable semantics instead of ad hoc scripting. It ships under an Apache 2.0 license and is already wired into AgentCore Policy, with liveness checks and multi-agent orchestration policies on the roadmap. For teams building agentic systems, it's a concrete answer to a real gap: rate limits, approval gates, and ordering constraints that point-in-time authorization alone can't express.

This is a summary by our content curator. Read the original at AWS Open Source Blog: https://aws.amazon.com/blogs/opensource/introducing-dogwood-runtime-verification-for-ai-agents/.