AWS has open-sourced Dogwood, a policy language for AI agent tool calls that can reason about what an agent already did. The project extends Cedar-style authorization with temporal conditions, so rules can govern sequences instead of isolated requests.
That matters because agents often chain tools into workflows. A team may want an approval before money moves, a running spending cap, or a rule that blocks external contact after confidential data is accessed. Cedar can evaluate one request at a time; Dogwood adds access to event history.
Dogwood introduces temporal operators for common patterns, including whether an event happened within a window, how many times something occurred, how many distinct values appeared, and running totals. AWS says AgentCore Policy already supports it, and existing Cedar policies continue to work.
The extra power has costs. Temporal evaluation requires state, can depend on event-log length, and does not support Cedar’s automated reasoning tools. AWS highlights a concurrency trap in which a rate limit based on completed responses can miss in-flight requests, a reminder that agent policy is also a distributed systems problem.