AWS Dogwood: Open source language for AI agent runtime verification

Dogwood enables policies that enforce sequential constraints, such as requiring approval before a sale, staying within usage limits, or preventing certain actions after accessing sensitive data. This is achieved through the `when temporal { ... }` clause, which evaluates past events in addition to the current request.

A Dogwood policy example demonstrates enforcing that a `SellShares` tool call is permitted only if a prior `ApproveSale` event for the same amount was granted within the last hour. This uses the `formerly` operator to look back in the event history.

Unlike Cedar, which focuses on point-in-time authorization, Dogwood introduces temporal conditions. These allow policies to look back over an agent's event history, enabling constraints on prerequisites, rate limits, and action ordering for complex agent workflows.

Dogwood policy support is now available within AgentCore Policy in Amazon Bedrock. Existing Cedar policies remain compatible, and customers can leverage Dogwood's temporal conditions to enhance current policies or create new ones for advanced agent control.

AWS has released Dogwood, an open-source governance language specifically designed for AI agents and their tool interactions. It provides a way to precisely specify and enforce rules about agent behavior, offering rigorous guarantees about how agents can affect the external world.

The Dogwood language is released as open source under the Apache 2.0 license, allowing users to define policies using their preferred tools. A parser, validator, and reference interpreter are available for exploring and testing Dogwood policies.