AWS open-sources Dogwood, a Cedar-derived policy language built for agent session history

AWS Machine Learning Blog·high signalXBlueskyLinkedInCopy link

Amazon Bedrock AgentCore added temporal policies — authorization rules that evaluate an agent's *sequence* of prior calls rather than each action in isolation, enforced at the gateway outside agent code so prompt injection can't bypass them. Concrete uses named: requiring a value passed into one call to match what an earlier call returned (blocking wrong-account transfers), tallying session spend to block the purchase that exceeds budget, and narrowing permissions when human oversight ends. The language behind it, Dogwood, is Apache 2.0 at github.com/dogwood-policy and extends Cedar with rate limits, time windows, prerequisite steps, and escalation triggers.