AWS Launches Dogwood to Fix 'Amnesia' in AI Agent Authorization
The new open-source policy language uses temporal logic to prevent agents from executing sequences of actions that are individually valid but collectively harmful.
AWS has released Dogwood, an open-source authorization policy language designed to secure AI agents by analyzing the sequence and timing of their actions. The release addresses a critical governance gap where autonomous agents can perform a series of authorized tool calls that lead to an unauthorized or harmful outcome.
Released under the Apache 2.0 license, Dogwood is integrated into Amazon Bedrock AgentCore. Unlike traditional access controls—such as OAuth or standard Role-Based Access Control (RBAC)—which evaluate each request as an independent event, Dogwood employs temporal logic. This allows administrators to define rules based on specific sequences; for example, a policy can mandate that an agent must verify an invoice before it is permitted to execute a payment. To maintain a robust framework, Dogwood does not replace the existing Cedar policy language but instead embeds it, adding temporal capabilities to Cedar's analyzable structure.
The Governance Gap
Traditional authorization systems treat tool calls in isolation, creating what analysts call a "mismatch" in AI governance. While an AI agent remembers its entire conversation and action history, the security checkpoint approving each individual action typically has no memory of what preceded it. This "amnesia" at the checkpoint allows for "valid but wrong" actions—such as an agent making multiple small payments that individually pass security checks but collectively exceed a daily corporate budget.
Marc Brooker, AWS VP and Distinguished Engineer, noted that the ability to perform an action often depends entirely on what has come before. By moving enforcement to the gateway layer, AWS ensures that these policies remain external to the agent's own code. This architectural choice prevents agents from bypassing security guardrails through prompt injection or other manipulation techniques.
Industry Implications
As AI agents transition from simple chatbots to autonomous workers with access to financial and corporate systems, the risk of emergent failures increases. Dogwood provides a mathematically precise method to enforce business logic over time, reducing the need for constant human oversight while maintaining strict security boundaries. This shift allows enterprises to deploy agents with greater confidence that the agent's cumulative behavior aligns with corporate policy.
What's Next
While Dogwood provides a powerful new toolkit for security engineers, the complexity of temporal logic may present a learning curve. According to Marc Brooker, it is expected that most developers will not write Dogwood policies manually, but will instead use AI agents to translate natural language business requirements into formal Dogwood policies. The industry will now be watching to see if this temporal approach becomes the standard for agentic orchestration as more companies move toward fully autonomous workflows.