Turn Natural Language into Agent Policies

🔑 Enhanced Key Takeaways

•Dogwood is an open-source governance language that extends Cedar, AWS's existing policy language, by adding support for temporal conditions.
•Temporal policies in AgentCore allow for stateful rules that evaluate an agent's session history, enabling advanced controls such as workflow sequencing, human approval gates, argument matching, data freshness checks, and aggregate limits across multiple actions.
•Policy enforcement is executed at the AgentCore Gateway, operating outside the agent's own code, which ensures that policies cannot be bypassed by prompt injection, agent reasoning, or code errors.
•The natural language policy authoring service automatically validates generated policies against the tool schema and employs automated reasoning to detect potential issues like overly permissive, overly restrictive, or unsatisfiable rules before deployment.
•Amazon Bedrock AgentCore, the underlying platform for these policy features, was launched in preview on July 16, 2025, and became generally available on October 13, 2025, serving as a successor to the original Bedrock Agents.

🛠️ Technical Deep Dive

Dogwood Policy Language: Dogwood is an open-source policy language, released under the Apache 2.0 license, that extends Cedar by introducing temporal conditions.
Compatibility with Cedar: Dogwood is fully backward-compatible with Cedar; any valid Cedar policy is also a valid Dogwood policy, allowing existing Cedar policies to function without migration.
Temporal Conditions: Unlike Cedar's point-in-time decisions, Dogwood enables policies to reference an agent's prior tool calls and responses within a session, supporting rules that depend on the sequence of actions.
Translation Mechanism: Under the hood, a temporal condition in Dogwood is translated into a Cedar context field, which the policy interpreter populates with event history before Cedar evaluates the decision.
Enforcement Architecture: Policies are enforced at the AgentCore Gateway, which acts as a secure, serverless entry point for AI traffic. The gateway intercepts agent-to-tool requests, queries the agent's trajectory (session history), evaluates the request against Dogwood policies, and then issues a deterministic ALLOW or DENY decision.
Isolation and Billing: AgentCore Runtime executes each agent session within a dedicated microVM, ensuring isolation and sanitizing memory upon session termination. CPU is only charged during active processing, not during I/O wait times for LLM responses or external tool calls.
Gateway Functionality: The AgentCore Gateway also serves as a secure hub for tool discovery, automatically converting existing AWS Lambda functions, APIs, and services into formats that agents can easily understand and utilize.

🔮 Future ImplicationsAI analysis grounded in cited sources

The adoption of Dogwood will lead to more robust and auditable AI agent deployments in regulated industries.

Its ability to enforce stateful, temporal policies and operate outside the agent's code directly addresses critical governance and compliance challenges for complex, multi-step agent workflows.

AWS will likely expand its natural language policy authoring capabilities to other governance domains beyond AgentCore.

The success of converting natural language to formal policies for AI agents demonstrates a valuable pattern for simplifying complex policy creation across various AWS services.

The open-sourcing of Dogwood will foster a broader ecosystem of agent governance tools and expertise.

An open-source policy language encourages community contributions, integrations, and the development of shared best practices for AI agent authorization.

⏳ Timeline

2023-11

Amazon Bedrock Agents (later 'Classic') launched, providing a managed way to build agents.

2025-07-16

Amazon Bedrock AgentCore launched in preview, offering a new, more flexible platform for AI agents.

2025-10-13

Amazon Bedrock AgentCore became generally available, replacing the original Bedrock Agents for new customers.

2025-12-04

Natural language policy authoring for AgentCore Policy, converting plain English into Cedar policies, was highlighted.

2026-03-07

AgentCore Policy was detailed, emphasizing centralized governance and context-aware authorization for agent-to-tool interactions.

2026-08-06

AWS open-sourced Dogwood, a temporal policy language extending Cedar, and integrated it with AgentCore Policy to enable stateful, session-aware authorization.