AWS Open-Sources Dogwood: Cedar Extended for Agent Tool-Call Sequences

AWS released Dogwood on August 16, 2026 — an Apache 2.0-licensed policy language that extends Cedar to reason across sequences of agent tool calls. It ships with integration into AgentCore Policy, the deterministic control layer AWS launched at re:Invent 2025 that intercepts and evaluates each tool call proposal before the model can act. Cedar itself became a CNCF sandbox project in late 2025. Dogwood's core innovation is that its policies can look backward at what an agent already did — something Cedar's stateless design deliberately excludes.

Cedar evaluates each authorization request in isolation. Feed it the same inputs twice and you get the same answer, independent of history or evaluation order. That property is what makes Cedar amenable to automated reasoning and formal verification. The cost is that Cedar cannot express constraints spanning multiple steps: "get approval before acting," "stay under a running total," or "stop contacting external parties after reading confidential data." As agentic systems grow more capable of composing multi-step tool workflows, that gap becomes a governance hole.

Dogwood closes it by introducing a when temporal clause alongside Cedar's when. Temporal conditions read the agent's event history — tool call requests and their outcomes, carrying input arguments and requesting principal. The action schema is derived from the agent's MCP tool manifest, one action per tool, which Dogwood generates automatically. Under the hood, a temporal condition is translated into a Cedar context field that the interpreter populates from the event log before Cedar makes its binary decision.

Four operators are exposed as standard-library macros over a core Metric First-Order Temporal Logic subset, not as language primitives: formerly (did something happen within a window), count_within (how many times), count_distinct_within (how many distinct values), and sum_within (a running aggregate). A bind operator assigns an aggregate a name so the current request can be compared against it.

The most instructive part of the release is a correctness trap platform engineers will recognise immediately. Consider a $5,000 transfer cap enforced by summing previous transactions. Three concurrent $2,000 transfers arrive before any settles. A policy summing response events sees nothing in flight and allows all three — $6,000 past the cap. The same policy summing request events denies the third. One word separates a working rate limit from a defeatable one. In multi-agent settings, tool calls interleave across principals, making this a distributed systems concurrency problem arriving in a new domain — with direct parallels to agent security vulnerabilities already surfacing in agentic coding contexts.

AWS is explicit that the released interpreter is for exploration and testing, not production authorization. The operational prerequisites the repository states: timestamps must be trusted, events authenticated, field and action names kept consistent across the trace, and one tenant's event history fully isolated from another's. Traces need durable storage, decisions need logging, and a retention policy is mandatory given that tool-call histories carry sensitive data. Dogwood's correctness guarantees are only as strong as the event log backing them. Any policies already written in Cedar remain valid Dogwood policies, so existing authorization logic requires no migration.

The tradeoff is explicit: temporal conditions do not support the automated reasoning tools Cedar provides. That is precisely why Dogwood is a separate language rather than a Cedar extension. Teams using temporal rules trade formal verifiability for the ability to govern multi-step behaviour — a deliberate and acknowledged loss.

The roadmap adds absolute-time windows for wall-clock-anchored rules, liveness properties asserting what must eventually happen rather than what must not, and orchestration policies for multi-agent handoffs and locks. The release was co-authored by Marc Brooker (VP and distinguished engineer at AWS, who led the Aurora DSQL launch), Joseph Tassarotti (Automated Reasoning Group), and Jean-Baptiste Tristan (AWS Agentic AI). AWS is not accepting external contributions yet, preferring to gather feedback before opening the language to outside changes.

The release landed the same week the MCP 2026-07-28 specification introduced required method and tool-name headers, making agent traffic inspectable at the HTTP layer. Headers tell a gateway which tool is being called; Dogwood expresses what a sequence of those calls is allowed to add up to — adjacent halves of the same governance problem. Teams shipping agents into regulated or high-stakes environments should treat the event log architecture Dogwood demands as a first-class system component, not an implementation detail.