AWS Open-Sources Dogwood to Add Temporal Rules to Agent Tool Calls

As AI agents move from generating answers to performing tasks, authorization can no longer focus only on a single tool request. An agent may read data, call external services, and initiate transactions in sequence or in parallel. The relevant question is often whether the entire chain of actions should be allowed. AWS has open-sourced Dogwood, a policy language designed to make that history visible to an authorization layer.

From one request to an execution history

Dogwood remains compatible with Cedar. Existing valid Cedar policies continue to work, while default deny and the precedence of forbid over permit remain unchanged. The major addition is the when temporal clause. Unlike Cedar’s request-by-request evaluation, it can inspect events representing earlier tool requests and their results, including inputs and the requesting principal.

This enables rules such as:

• requiring approval before a sensitive action;
• limiting the number of calls or total value within a time window;
• stopping external communication after confidential data has been accessed;
• using earlier workflow events to decide whether the current call is permitted.

Dogwood derives operation patterns from an agent’s MCP tool catalog. Its temporal expressions are translated into Cedar context fields: an interpreter first populates those fields from the event history, after which Cedar evaluates the decision. The language offers formerly, count_within, count_distinct_within, and sum_within for checking prior events, counting occurrences, counting distinct values, and aggregating totals. bind gives an aggregate a name so it can be compared with the current request.

Concurrency exposes a subtle failure mode

The most instructive example concerns transfer limits. A policy that sums completed responses can miss several concurrent transfers when none has completed yet. Three requests may therefore pass a limit that should have blocked the combined amount. A policy that sums request events instead can reject the third request before the limit is exceeded.

The difference is small in policy syntax but significant in a distributed system. Agents commonly issue tool calls in parallel, and multiple agents can interleave their actions. A rule that appears correct under sequential reasoning may fail once request and response timing diverge. Policy authors must decide whether a constraint belongs to the request, the result, or the evolving workflow state.

More expressive, but harder to operate

Temporal evaluation requires stateful tracking, and evaluation cost may depend on the length of the event log. Policies using temporal clauses also lose Cedar’s automated reasoning and formal-analysis capabilities. AWS presents this trade-off as a reason for creating a separate language rather than simply extending Cedar.

Dogwood’s reference interpreter is intended for exploration and testing, not production authorization. A dependable deployment still needs trusted timestamps, authenticated events, durable and tenant-isolated traces, decision logs, and carefully managed retention because tool histories can contain sensitive information. Without a trustworthy event log, temporal policy has little meaning.

Dogwood complements MCP infrastructure changes that make agent methods and tool names easier for HTTP systems to identify. MCP helps expose what an agent is calling; Dogwood describes when a series of such calls should remain permitted. Planned areas include absolute time windows, liveness properties, and orchestration rules for handoffs and locks in multi-agent systems.

Source: InfoQ 中文