AWS Dogwood: The Open-Source Governance Language Giving AI Agents a Memory

In Dogwood, a policy’s decision depends on the history of an agent’s actions within a session, not on the current request alone . The policy engine maintains a record of prior tool calls and their responses, then evaluates the current request against that history before permitting or denying the call .

Extending Cedar with Temporal Operators

Dogwood extends the Cedar policy language (AWS’s existing authorization language from 2023) by adding a temporal block with session-aware conditions . Key temporal operators include:

These operators let a policy define rules like “forbid a payment action unless an invoice action happened formerly,” or “forbid if

sum_within(amount, 1h)

temporal { ... }

Gateway-Layer Enforcement (Bypass-Proof)

Temporal policies are enforced at the AgentCore Gateway layer, outside the agent’s own code . The gateway intercepts every tool call in real time before it reaches the target tool, evaluates the policy against the session’s full event history, and then permits or denies the call .

Because the authorization decision happens at the perimeter — in infrastructure the agent cannot modify — it cannot be bypassed by prompt manipulation, jailbreaking, or any code the agent controls . AWS explicitly states that policies run at the “AgentCore Gateway perimeter, outside the agent’s own code,” making them resistant to the agent rewriting its own instructions . The policy engine supports two modes: LOG_ONLY (audit without blocking) and ENFORCE (actively deny) .

AWS Service Integration: Amazon Bedrock AgentCore

Dogwood has been integrated into Amazon Bedrock AgentCore as temporal policies, announced alongside gateway rate limiting on August 6, 2026 .

Currently available features in Bedrock AgentCore:

• Temporal policies — stateful rules using Dogwood that evaluate each tool call against the agent’s session history .
• Gateway rate limiting — token throughput caps on a per-identity basis (Basic: 100 RPM, Advanced: 300 RPM) .
• Policy engines — you create a policy engine, store policies (both standard Cedar and temporal Dogwood), and associate it with an agent .
• Per-session budgets — e.g., a $60,000 per-session spending cap enforced via sum_within .
• Workflow sequencing rules — e.g., require an approval action before a payment action .
• Log-only and enforce modes — run temporal policies in log-only mode against real traffic before switching to enforcement .

The Dogwood language and its reference implementation are available on GitHub under Apache 2.0, separate from the Bedrock AgentCore managed service .