Your AI agent’s next tool call may be valid but wrong. AWS’s Dogwood promises to fix that.

AWS has a habit of naming things after trees, and Dogwood is the latest branch off Cedar, the authorization language it already uses to gatekeep AI agent tool calls inside Amazon Bedrock AgentCore. Cedar answers a narrow question well: given this exact request, right now, should it be allowed? Dogwood answers a harder one. Given everything this agent has done in the last hour, should this particular request go through?

That distinction matters more than it sounds. Cedar is stateless by design, which makes it predictable and easy to audit, but it also means it has no memory. Ask it the same question twice and you get the same answer, even if the agent quietly drained a budget or skipped an approval step three requests ago. AWS's own stock-trading example makes the gap obvious: a policy that only lets an agent sell shares if a separate approval tool signed off within the past hour simply can't be written in Cedar alone, because Cedar doesn't know what happened an hour ago.

The trickier problem, and the one that shows Dogwood actually earns its complexity, is concurrency. Say an agent is capped at $5,000 in transfers per hour. Fire off three $2,000 requests nearly simultaneously and a naive system checking only completed transfers sees zero dollars spent when each request lands, then approves all three. Dogwood counts in-flight requests too, so the third $2,000 ask gets denied before any of the earlier ones even finish. AWS built this on a slice of Metric First-Order Temporal Logic, letting developers count events, tally distinct values like payment recipients, or sum totals across a time window instead of just checking a single fact.

Wisely, AWS didn't throw Cedar out. Every existing Cedar policy is a valid Dogwood policy, and the new temporal conditions get translated into a Cedar context field before the actual authorization decision happens. That backward compatibility should ease adoption. What won't ease adoption is the fine print: the reference interpreter released under Apache 2.0 is explicitly not production-ready, and running real temporal policies means solving for trusted timestamps, tenant isolation, durable event storage, and a retention policy for what could be sensitive tool-call histories. AWS is treating this as a starting point for feedback, not a finished product, and for now it isn't accepting outside code contributions at all.

Where this goes next is multi-agent systems, where AWS wants Dogwood governing handoffs and shared locks between agents rather than just a single agent's own action sequence. That's a genuinely harder problem than rate-limiting one agent's refunds, and it's not solved yet.