TL;DR — Key Takeaways
- AWS has open sourced Dogwood, a policy language designed to govern AI agents by enforcing rules across sequences of actions rather than evaluating each request in isolation.
- Dogwood can require approvals, enforce spending or usage limits and restrict what agents can do after accessing sensitive information.
- The language uses temporal logic to make policies such as “A must happen before B” programmatically enforceable and auditable.
Amazon Web Services has made available a programming language for applying policies to artificial intelligence (AI) agents, dubbed Dogwood, as an open source project under an Apache 2.0 license.
Dogwood is a governance language specifically designed to limit what an AI agent is allowed to do by programmatically applying policies over sequences of actions and tasks. That capability makes it possible to both define policies with an integrated development environment (IDE) or AI coding agent, and explore AI agent behavior using a Dogwood parser, validator and reference interpreter.
Additionally, Dogwood is being incorporated into AgentCore Policy to make it possible to apply very deterministic guardrails to the behavior of an AI agent, says Clare Liguori, a senior principal software engineer at AWS.
“Dogwood allows you to put in place a temporal policy, meaning A must happen before B,” says Liguori. “It allows you to specify policies that your agents have to follow.”
Application developers, as a result, are able to require an agent to get approval before acting, stay under a running limit, or never contact external parties once it has accessed confidential information. Dogwood also provides a means to sum the data associated with events. As a result, the total number of dollars that can be transferred in a window can be programmatically limited.
Developers can also define their own macros to name recurring patterns, build a shared library and declare a richer event model that incorporates additional kinds of events beyond request/response events for tool calls. Dogwood also supports defining new information providers to create small sandboxed functions that compute a fact that a policy can then read inline. It includes a way to generate the action schema straight from a Model Context Protocol (MCP) tool manifest that can be applied to a template that models the identities an agent authenticates.
AWS previously developed Cedar, another open source language that is used to apply policies as code, which is now being advanced under the auspices of the Cloud Native Computing Foundation (CNCF). Dogwood is designed to be compatible with existing Cedar-based policies, but those policies only enable point-in-time authorization decisions where each request is evaluated in isolation. Dogwood applies rules across a sequence of current and recent events using a mathematical foundation known as temporal logic.
Authorizing one request at a time doesn’t work for an agent, since the risk lives in the sequence rather than any single call, says Mitch Ashley, vice president and practice lead for software lifecycle engineering for the Futurum Group. “Platform teams could not prove approval came before the transfer,” he notes. “Dogwood makes that checkable.”
Naturally, determining how best to govern AI agents is of paramount concern to enterprise IT organizations that need to prevent any rogue behavior. The challenge, and the opportunity, lies in determining how best to embed that governance into AI agents themselves when many of the controls that are currently in place in the enterprise are relatively trivial for an AI agent to circumvent.