Amazon Bedrock AgentCore Converts Prose Policies to Dogwood Rules
In this article
Amazon Bedrock AgentCore's Policy feature now includes a natural-language-to-Dogwood translation pipeline that converts prose compliance documents into enforceable, formally verified agent governance rules. The latest expansion adds support for temporal and trajectory constraints that weren't expressible in earlier versions. For teams already maintaining policy documents for human staff, the same document can now feed an automated authorization engine without requiring anyone to learn a formal specification language first. Given how often agent deployments surface unexpected control gaps, a declarative, open-source governance language with a managed authoring layer is a meaningful step toward auditable agentic infrastructure.
What Dogwood Enforces and How AgentCore Applies It
Dogwood is an open-source governance language whose policies are applied in real time by the Dogwood monitor embedded inside AgentCore Gateway. The language is default-deny and operates on a precedence rule: a forbid overrides a permit. Every authorization decision can inspect either the current tool call or the history of completed and attempted calls within the same session — the latter being the basis for temporal policies.
The five constraint categories supported are: restrictions on input parameters of tool calls, prerequisites and sequential ordering requirements, cumulative effect caps, rate limits, and semantic checks on free-form text via Amazon Bedrock Guardrails. Temporal conditions use a formerly within <window> construct that looks backward from the moment of decision. The window slides with the clock rather than resetting on calendar boundaries, which the documentation flags as something policy authors must handle explicitly if calendar-based resets are needed.
Policies reference tools by name from the agent's Model Context Protocol (MCP) tool manifest. The schema fed to Policy Authoring carries tool names, input argument names and types, and output field names and types, so generated field references like context.input.amount are anchored to the actual arguments the deployed agent calls.
The Four-Step Autoformalization Pipeline
Policy Authoring runs in four sequential stages. First, decomposition splits compound prose rules into atomic statements, each concerning a specific tool or set of tools and enforceable independently. Second, routing determines whether each atomic rule is expressible in Dogwood; rules that fall outside the language — those that describe transformations rather than permit/deny verdicts, reference cross-session state, require a day-of-week accessor, or express no condition on any action at all — are set aside rather than translated. Third, the surviving rules are autoformalized using the tool schema as an anchor for field names. Fourth, every candidate policy is validated by the same Dogwood command-line tools that ship with the open-source language. When a candidate fails validation, diagnostics are fed back and translation retries for a bounded number of rounds. The output is two collections: validated policies paired with the natural-language rules that generated them, and the set of rules that were set aside with labels indicating why.
Concrete Policy Translations
The retail bank scenario in the documentation illustrates what each constraint type looks like in practice.
| Constraint type | Natural language rule | Key Dogwood mechanism | Session history required? |
|---|---|---|---|
| Argument + time window | Refunds only 9:00 AM–5:00 PM UTC and ≤ $2,500 | context.system.now.toTime() + context.input.amount |
No |
| Prerequisite / ordering | Transfer only after identity verified for same account within 15 minutes | formerly within 15m … ::response{ output.verified: true } |
Yes (outcome) |
| Cumulative cap | Block transfer if sum of transfers in past 12 hours exceeds $50,000 | sum a for … formerly within 12h ::request |
Yes (attempts) |
| Rate limit | No more than three refunds against same account within one hour | count for … formerly within 1h ::request |
Yes (attempts) |
| Free-form semantic check | Reject dispute filings whose description contains a Social Security number | BedrockGuardrails::SensitiveInformation(["US_SOCIAL_SECURITY_NUMBER"], …).maxConfidenceScore().greaterThanOrEqual(decimal("0.2")) |
No |
The Guardrails integration defaults the confidence threshold to 0.2 when the prose rule states no explicit level; a rule that names a number or says "with high confidence" carries that value through directly. The cumulative-cap example also surfaces a documentation best practice — the policy sums ::request events (all attempts, including denied ones) rather than ::response events, which is the conservative reading when the prose is ambiguous about whether failed transfers count toward the cap.
What the Authoring Service Cannot Express
Four categories of rules are explicitly set aside. A rule with no condition on any tool or action — "agents should exercise sound professional judgment" — belongs in the agent's instructions, not an authorization engine. A rule that asks for a transformation of a call's payload — redacting a Social Security number before storing a dispute note — requires a different control applied at a different pipeline stage. Rules that depend on Dogwood constructs that don't exist, such as a day-of-week accessor or a federal holiday calendar, cannot be approximated. And rules that pool state across concurrent sessions — a per-customer daily transfer cap spanning all of that customer's simultaneous sessions — fall outside trajectory enforcement, which operates within a single session.
The practical value of explicit set-aside labels is that they force a policy review decision: rewrite the rule, move it to a different control mechanism, or accept that it remains a human process. A rule that validates cleanly but enforces the wrong thing is worse than a rule that is flagged as inexpressible.
The broader pattern here is that the agent-safety problem is increasingly being addressed at the infrastructure layer rather than the model layer. Shipping an open-source policy language with a managed compiler, a formal validator, and an LLM-powered authoring front-end is an architectural bet that governance belongs in the execution fabric — enforced on every tool call, regardless of which model drives the agent.