AWS Releases Dogwood, a Policy Language for AI Agents

AWS has released Dogwood, a policy language designed to control the behavior of AI agents, as open source. It extends the existing policy language Cedar and is available under the Apache 2.0 license. It is also supported by AWS's service AgentCore Policy.

First, a "policy language" is a specialized language for describing rules about what a system is "allowed" or "not allowed" to do. Cedar is a policy language already provided by AWS and has been used for access control management. Dogwood is positioned as an extended version of Cedar that adds "temporal conditions." AI agents are AI systems that receive instructions from humans and autonomously invoke multiple tools and services to complete tasks. Their adoption has been rapidly expanding in recent years.

Traditionally, access control has evaluated each request individually on a case-by-case basis. In contrast, Dogwood can apply rules based on the "past history" of operations the agent has performed. Specifically, it enables controls such as approval flows (requiring permission before performing an operation), rate limiting (managing the maximum number of operations within a specified period), and cumulative counting (tracking the total sum of past operations).

However, AWS explicitly states that the reference implementation (reference working sample) currently released is not intended for production environment use. Separate measures will be necessary when integrating into actual systems, and it remains merely a reference implementation for confirming specifications and design.

The importance of this initiative stems from the fact that as AI agents become widely used, their risk management has become a critical challenge. Because agents invoke multiple tools in sequence, traditional methods that evaluate safety based on individual operations alone have become insufficient in some cases. There was a need for mechanisms that could provide control based on an understanding of the entire sequence of operations.

By releasing it as open source, the developer community can more easily verify and validate the specification. How to design governance for AI agents is an industry-wide issue, and Dogwood can serve as one approach for reference. Combined with support in AgentCore Policy, this represents a deployment strategy that also considers integration with AWS's agent development platform.

As AI agent adoption accelerates, the concept of "dynamic control considering history" beyond simple access management can influence standard discussions in future agent design. How the reference implementation matures toward production readiness and how the community contributes will be key areas of focus going forward.