AWS Dogwood: Governing Agent Action Sequences

Temporal Logic for AI Agents

AWS's open-sourcing of Dogwood represents a crucial advancement in AI agent governance, directly addressing the limitations of Cedar by enabling policies that consider the history of agent actions. This is particularly relevant as AI agents move beyond single-turn interactions to complex workflows. The ability to enforce constraints like 'get approval before acting' or 'stay under a running total' based on past events is a significant step towards more reliable and secure AI systems, especially in regulated environments. The introduction of temporal condition types like formerly, count_within, and sum_within provides powerful tools for expressing these sequential dependencies. The analogy to distributed systems problems like concurrency and the explicit mention of the rate-limiting example highlight the practical challenges Dogwood aims to solve.

However, the article also points out significant trade-offs. The primary concern is the loss of automated reasoning capabilities when using temporal conditions, which is a major drawback for formal verification and auditing, areas critical for production-grade AI. The reliance on a trusted event log, robust storage, and strict data isolation between tenants introduces substantial operational overhead. While the reference interpreter is for exploration, building a production-ready authorization system based on Dogwood will require considerable engineering effort to establish these foundational trust mechanisms. The licensing under Apache 2.0 is a positive step for community adoption, but AWS's current stance on not accepting contributions yet suggests a cautious approach to external involvement, which might slow down community-driven development and validation.

Key Points

• AWS open-sourced Dogwood, a policy language extending Cedar to govern sequences of agent tool calls.
• Dogwood's key innovation is its ability to look backward at an agent's event history (tool call requests and outcomes) for policy evaluation.
• New temporal condition types (formerly, count_within, sum_within, bind) allow for governing sequences based on past events, unlike Cedar which focuses on single requests.
• Addresses real-world agent use cases like sequential approvals, running totals, and avoiding repeated external contact.
• Highlights the challenge of concurrency in agent actions and how Dogwood's event-based approach handles it more robustly than request-based policies.
• Limitations include the loss of automated reasoning capabilities for temporal conditions and the significant operational overhead for building a trusted event log infrastructure.
• The reference interpreter is for exploration, not production authorization; building a production system requires careful consideration of trust, security, and durability.
• Existing Cedar policies remain valid, and Dogwood policies are backward compatible.

---

📖 Source: AWS Open-Sources Dogwood, Extending Cedar to Govern Sequences of Agent Tool Calls