AWS Releases Dogwood: A New Policy Language for Enhanced Agent Tool Calls
In a significant move for cloud security and automation, AWS has recently open-sourced Dogwood, a groundbreaking policy language specifically designed for agent tool calls. This new language offers unique capabilities that set it apart from its predecessor, Cedar, primarily by enabling retrospective evaluations of an agent’s actions. As we explore Dogwood’s noteworthy features and implications, we will also look at its integration with existing AWS infrastructures.
What is Dogwood?
Dogwood is a policy language crafted to enhance the decision-making framework for agents performing tool calls. Unlike Cedar, which evaluates policies based solely on individual requests, Dogwood incorporates historical data, allowing it to consider the sequence of actions an agent has previously executed. This innovative feature enables more complex and context-aware decision-making rules.
Licensed under Apache 2.0, Dogwood is supported by AgentCore Policy, a deterministic control layer that was launched at AWS re:Invent last year. This control layer operates independently of the model, acting as an intermediary that either accepts or rejects proposed tool calls without the model itself engaging in enforcement.
The Relationship Between Dogwood and Cedar
While Cedar took a straightforward approach by examining one request at a time and making decisions based on that singular context, Dogwood introduces a richer dimension. It permits conditional checks based on the agent’s past actions, thereby enhancing the framework’s robustness. Cedar is currently a sandbox project within the Cloud Native Computing Foundation (CNCF), contributing to the ongoing evolution of policy languages.
The Limitation of Cedar’s Design
Cedar’s design, focusing on isolated requests, poses significant limitations. For instance, if you feed the same request to Cedar in different scenarios, the responses will remain consistent regardless of prior actions. This restriction can impede organizations when they want to impose conditions relating to sequences of actions—such as requiring approvals or managing cumulative totals.
More Read
![Revolutionizing Protein Folding: Lightweight MSA Design Using Evolutionary Embeddings – [2507.07032]](https://aimodelkit.com/wp-content/uploads/2025/04/1745946105_arxiv-logo-fb-150x150.png "Revolutionizing Protein Folding: Lightweight Msa Design Using Evolutionary Embeddings – [2507.07032]"){kind=logo}
Key Features of Dogwood
Temporal Conditions
One of Dogwood’s standout features is its ability to utilize temporal conditions that allow rules to take into account not only when an action occurs but also what has transpired before it. This capability is made possible through a second clause type that interacts with the agent’s event history, representing tool call requests and their outcomes.
Operators and Functionality
Dogwood comes equipped with four primary operators designed to cover various logical conditions:
- Formerly: Checks if an event occurred within a specified time window.
- count_within: Counts the number of occurrences within that time frame.
- count_distinct_within: Tracks how many different values have occurred within the window.
- sum_within: Computes a running total.
Additionally, the bind operator allows users to name these aggregates for easy comparison with current requests.
Challenges and Considerations
While the advancements are significant, AWS acknowledges considerable challenges associated with Dogwood. Notably, temporal evaluation necessitates stateful tracking of events, which can increase evaluation times based on the length of the event log. Moreover, policies that use temporal conditions do not support Cedar’s automated reasoning tools, which means that the ability to formally analyze these policies is lost.
Asynchrony in Agent Operations
The asynchronous nature of agent operations presents a unique challenge. Agents often issue tool calls in parallel, and the interleaving of these calls can complicate policy enforcement. For instance, a policy examining responses rather than requests could lead to incorrect approvals during concurrent actions, highlighting the complexity of managing state in multi-agent environments.
Compatibility with Existing Policies
An attractive feature for current users of Cedar is that all valid Cedar policies remain compatible with Dogwood. This means organizations can transition to using Dogwood without having to rewrite existing policies. The fundamental principles, such as deny-by-default and overriding permissions, remain in place.
Security and Trust Requirements
While the release of Dogwood brings new capabilities, AWS stresses that using it in production requires careful consideration. The reference interpreter serves primarily for exploring the language and not for live authorization. Security measures such as trusted timestamps, authenticated events, consistent naming conventions, durable storage for traces, and strict retention policies are critical to establishing a trustworthy event log.
Future Directions
The future of Dogwood includes several promising enhancements such as the introduction of absolute-time windows for rule applications, liveness properties to ensure certain outcomes will eventually occur, and orchestration policies designed for managing multi-agent interactions. Each development aims to expand the capabilities of agent-based systems within the AWS ecosystem.
Notable Contributors
AWS has positioned itself at the forefront of advancing agent technology through collaborations led by prominent figures within the company. Marc Brooker, a VP and distinguished engineer, has been instrumental in the creation of Dogwood, working alongside other experts to refine and stabilize the language before opening it for contributions from the community.
By offering Dogwood as an open-source project, AWS aligns itself with the broader trends in cloud technology, inviting collaboration to enhance the robustness and flexibility of agent operations for organizations around the globe.
Inspired by: Source
