AWS Dogwood: Governing AI Agent Actions Over Time
AWS has launched Dogwood, an open-source policy language designed for runtime verification of AI agents. Released under the Apache 2.0 license, Dogwood extends AWS's existing authorization language, Cedar, by addressing a fundamental limitation: Cedar's inability to reason about sequences of actions over time. This new capability is critical for governing the complex, multi-step workflows that AI agents increasingly execute.
The core of Dogwood's innovation lies in its ability to handle stateful decision-making. Unlike Cedar, which operates on a stateless, point-in-time basis—evaluating each request independently—Dogwood can track and enforce policies across a series of actions. This is essential because, as AWS notes, "Point-in-time decisions make sense for many forms of access control, but when agents compose multiple actions into longer workflows, the sequence itself becomes something teams want to govern." Dogwood fills this precise gap.
The Limitations of Cedar
Cedar, a CNCF sandbox project, excels at defining permissions for individual requests. When an agent makes a call, Cedar receives the request—comprising the principal, action, resource, and parameters—and returns a definitive allow or deny. Its stateless nature means that each decision is independent; the outcome of previous actions does not influence the evaluation of the current one. This predictability is valuable for auditability and static analysis, but it creates a blind spot when agents perform multi-step operations.
Consider a common scenario: an AI agent tasked with financial operations. An organization might want to restrict an agent to transferring no more than $5,000 per hour. Cedar, in its stateless form, can verify if a single transfer request exceeds $5,000. However, it cannot inherently track the cumulative amount transferred within a given hour across multiple, sequential requests. If an agent makes several smaller transfers that, when summed, exceed the hourly limit, Cedar alone cannot prevent this violation. This is where Dogwood's stateful reasoning becomes indispensable.
Dogwood's Stateful Approach
Dogwood introduces the concept of temporal reasoning to policy enforcement for AI agents. It allows developers to define policies that consider the history of an agent's actions. This means policies can be written to limit cumulative actions, enforce order dependencies, or ensure specific conditions are met over a period. For the financial transfer example, Dogwood could maintain an internal state tracking the total amount transferred by an agent within the current hour. Subsequent transfer requests would then be evaluated not just on their individual merits but also in the context of this running total, ensuring adherence to the $5,000 hourly cap.
The implications extend beyond simple financial limits. AI agents are increasingly used for complex tasks such as orchestrating cloud infrastructure deployments, managing data pipelines, or interacting with multiple third-party APIs. In these contexts, the order of operations and the cumulative effect of actions are paramount. For instance, an agent might be authorized to create a virtual machine, but Dogwood could enforce a policy that requires a security group to be created and attached *before* the VM is accessible externally. Or, an agent might be allowed to read a file, but Dogwood could prevent it from writing to the same file until a specific validation step has been completed.
Extending Cedar's Ecosystem
Dogwood is designed to integrate seamlessly with Cedar. Developers can leverage their existing knowledge of Cedar's policy syntax and structure, adding temporal and sequential logic where needed. This approach minimizes the learning curve and allows organizations to incrementally adopt stateful policy enforcement for their AI agents. The choice of an open-source model under Apache 2.0 ensures broad community adoption and contribution, fostering a robust ecosystem around AI agent security and governance.
The development of Dogwood signals a maturing landscape for AI agent development. As agents become more autonomous and capable of performing complex, multi-step tasks, the need for sophisticated governance and verification mechanisms grows. Traditional access control models, which are often stateless, are insufficient for this new paradigm. Dogwood directly addresses this by providing a way to define and enforce policies that understand the flow and consequences of actions over time. This capability is not just about preventing unauthorized access; it's about ensuring agents operate within defined operational boundaries, maintain system integrity, and align with business logic across their entire operational lifecycle.
What's Next for AI Agent Policy?
The introduction of Dogwood raises an important question: how will this capability influence the design of future AI agents and their tooling? As developers gain the ability to enforce complex, stateful policies, we can expect to see agents designed with more intricate workflows, confident that their operations can be reliably governed. This could lead to a new generation of AI agent frameworks that are built with temporal policy enforcement as a first-class concern. Furthermore, the open-source nature of Dogwood and Cedar suggests a future where policy-as-code for AI agents becomes a standard practice, akin to infrastructure-as-code, enabling greater automation, security, and audibility in AI systems.