AWS Dogwood & AgentCore Temporal Policies: The Agentic AI Architect’s Guide (2026)

Why Your AI Agent’s Last Tool Call Is the Wrong Question

A stock-trading agent calls get_market_price, receives a quote for AMZN at $215.40, then passes execute_trade with a portfolio ID it hallucinated — one belonging to a completely different client. Each tool call, evaluated in isolation, passes every access-control check. The agent has permission to fetch prices. It has permission to execute trades. But the sequence is catastrophic: the trade targets an account the agent never looked up.

This is the gap that traditional authorization was never designed to close. Point-in-time access control — the kind every cloud provider has shipped for years — answers one question: “Is this principal allowed to call this tool right now?” It cannot answer the question that actually matters for autonomous agents: “Given everything this agent has done in the last five minutes, should it be allowed to do this next thing?”

On August 6, 2026, AWS released Dogwood, an open-source temporal policy language purpose-built for AI agent governance, alongside temporal policies in Amazon Bedrock AgentCore. Together, they represent the first production-grade infrastructure for enforcing stateful authorization rules across agent tool-call sequences — and they solve a problem that every enterprise deploying agentic AI has been duct-taping around with prompt engineering and hope.

This guide breaks down what Dogwood is, how temporal policies work inside AgentCore, the seven governance patterns AWS shipped on day one, and what this means for agentic AI architects building production systems in 2026.

The Problem: Point-in-Time Authorization Cannot Govern Agents

Traditional access control — IAM policies, RBAC, OAuth scopes — treats every request as independent. A user either has permission to call an API or doesn’t. That model worked for decades because applications followed deterministic code paths: a developer wrote the business logic that decided which API to call, with which arguments, in which order.

AI agents break that assumption entirely. An agent decides at runtime which tools to call, with which arguments, and in what sequence. The LLM is the control flow. And that means:

• A valid tool call can be harmful given what preceded it. Reading from an untrusted data source, then writing to a production database with the values obtained — both calls individually authorized, but the sequence constitutes a data-poisoning attack.
• Agents can hallucinate intermediate values. An agent retrieves a customer record, then fabricates a different account number when calling the next tool. No stateless policy catches this because the fabricated value is syntactically valid.
• Concurrent tool calls bypass rate limits. An agent fires 20 transfer requests simultaneously. Each one is individually under the per-transaction limit. By the time the first response returns, $200,000 has moved.
• Runaway loops accumulate damage invisibly. An agent executing small trades in a loop — each individually reasonable — can blow past a cumulative risk limit before any single check triggers.

These are not hypothetical edge cases. As we covered in our guide to AI Agent Control Planes, the enterprise governance challenge for agentic AI has been the defining infrastructure gap of 2026. AWS’s answer is to move authorization from point-in-time to trajectory-aware — and they built a new language to make it work.

What Is Dogwood?

Dogwood is an open-source policy language released under the Apache 2.0 license. It extends Cedar — the policy language AWS built for Amazon Verified Permissions and IAM — with temporal conditions that let policies reference the history of prior events within an agent session before deciding whether to permit the current action.

More Read

A Beginner’s Guide to Agentic AI: Working with CrewAI

The Universal Commerce Protocol: Google’s Open-Source Standard for the Agentic Commerce Era

Building Multi-Agent Systems with Google ADK: The Complete Step-by-Step Guide

The key distinction: Cedar handles point-in-time decisions where each request is evaluated in isolation. Dogwood adds session-aware patterns — workflow sequencing, human approval gates, argument matching, data freshness checks, and aggregate transfer limits — that require looking backward across a trace of events.

Three properties make Dogwood architecturally significant for agentic AI governance:

1. Full Cedar Backward Compatibility

Any syntactically valid Cedar policy is a syntactically valid Dogwood policy. Organizations already using Cedar for IAM or Verified Permissions can adopt Dogwood without migrating existing policies. Temporal conditions are additive — you add when temporal { ... } clauses alongside your existing when { ... } clauses, and both must hold for the request to be authorized.

2. Mathematical Foundation in Temporal Logic

Dogwood is built on Metric First-Order Temporal Logic (MFOTL), a branch of formal methods called runtime verification. This is not a marketing term — it is a precise mathematical foundation for reasoning about ordered sequences of events over time. The same theory underpins safety-critical systems verification in aerospace and finance. Applied to AI agents, it means Dogwood policies produce deterministic, auditable decisions: identical traces yield identical verdicts, regardless of evaluation order or system state.

3. Perimeter Enforcement, Not Prompt Engineering

Dogwood policies run at the AgentCore Gateway perimeter, outside the agent’s own code and reasoning loop. The agent never sees the policy logic, never touches the state store, and cannot alter the controls — regardless of what the LLM is prompted to do, regardless of bugs in agent code, regardless of prompt injection attacks. This is the critical architectural difference between governance-by-policy (deterministic, tamper-proof) and governance-by-prompt (probabilistic, bypassable).

Dogwood’s Core Temporal Operators

Dogwood ships with a standard library of macro operations built on MFOTL primitives. For most governance use cases, these macros are all you need. Here is what each does, with examples from the AWS documentation.

formerly — “Did this happen before?”

The formerly operator is backward-looking: it holds if a specified condition occurred at least once within a time window. This is the building block for prerequisite checks and workflow sequencing.

permit (principal, action == AgentCore::Action::"SellShares", resource)
when temporal {
    formerly within 1h AgentCore::Action::"ApproveSale"::response{
        input.stock:     context.input.stock,
        input.shares:    context.input.shares,
        output.approved: true
    }
};

This policy says: permit a share sale only if an approval for the exact same stock and quantity came back granted within the last hour. Note the argument matching — input.stock and input.shares must match between the approval response and the current sell request. The agent cannot reuse an approval for AMZN to sell GOOGL.

count_within — “How many times?”

Counts events in a sliding window. This is the operator for rate-limiting policies — “no more than five transfers in an hour, however small each one is.”

forbid (principal, action == AgentCore::Action::"Transfer", resource)
when temporal {
    count_within(1h, AgentCore::Action::"Transfer"::request{ input.amount: _ }) > 5
};

count_distinct_within — “How many different things?”

Counts distinct values across events: not “how many transfers” but “how many different recipients.” Useful for policies like “an agent may transfer to at most three distinct recipients per hour.”

sum_within — “What’s the running total?”

Sums a numeric field across events in a window. This is the operator for cumulative budget caps — “no more than $5,000 transferred in the last hour, across any number of transactions.”

forbid (principal, action == AgentCore::Action::"Transfer", resource)
when temporal {
    sum_within(a, 1h, AgentCore::Action::"Transfer"::request{ input.amount: a }) > 5000
};

A critical subtlety noted in the AWS documentation: these rate-limiting policies should sum ::request events, not ::response events. If you sum only completed responses, an agent can circumvent the limit by firing many concurrent requests before any resolves — all of them will be authorized because no responses have landed yet. Summing requests counts in-flight operations and closes the concurrency loophole.

bind — “Name the aggregate, then compare”

The bind operator lets you assign a name to an aggregate result so the current request can be compared against it. This enables anti-spike rules like “a single transfer must not exceed everything that has already settled this hour.”

The Seven Temporal Policy Patterns for Production Agents

AWS’s launch blog walked through a private-banking portfolio agent to demonstrate seven concrete patterns. These patterns generalize well beyond financial services — any domain where agents interact with sensitive tools at runtime faces the same governance challenges. Here is each pattern, what it prevents, and when to apply it.

Pattern 1: Workflow Sequencing (Multi-Hop Chain)

What it enforces: The agent must call get_client_profile, then load_portfolio, then execute_trade in that order. Skipping a step results in denial.

Why it matters: Without the client profile, the agent has no system-verified context about which portfolios belong to the client, what the risk tolerance is, or what restrictions apply. An agent that jumps directly to trading without loading the profile is operating on hallucinated or cached data.

Generalized use case: Any multi-step workflow where order matters — KYC verification before account creation, diagnosis before prescription, data validation before write operations.

Pattern 2: Output-to-Input Integrity

What it enforces: The portfolio_id passed to execute_trade must exactly match one returned by get_client_profile. The agent cannot fabricate or substitute a different ID.

Why it matters: This is the anti-hallucination guardrail. Even if a prompt-injection attack convinces the LLM to use a fabricated ID, the temporal policy at the gateway verifies the value against what the CRM system actually returned. The mismatch triggers a denial that the agent cannot override.

Generalized use case: Any chained tool-call sequence where downstream actions must use values from upstream responses — order IDs, patient identifiers, document references, approval codes.

Pattern 3: Data Freshness

What it enforces: A get_market_price call must have completed within the last 30 seconds before execute_trade is authorized.

Why it matters: In volatile markets, even a 60-second-old quote can represent significant price drift. This forces the agent to refresh data before every consequential action. The same pattern applies to any domain where stale data creates liability — medical records, inventory levels, regulatory status.

Pattern 4: Cumulative Budget Cap

What it enforces: Total trade value within a single session cannot exceed $60,000. After the cap is hit, all trades are denied until a new session begins.

Why it matters: A compromised or malfunctioning agent executing many small, individually-reasonable trades can accumulate catastrophic exposure before any single check triggers. The cumulative cap catches what per-transaction limits miss.

Pattern 5: Human Approval with One-Time Consumption

What it enforces: Any trade exceeding $25,000 requires explicit advisor approval. Each approval is consumed by a single trade — a second large trade requires a fresh approval.

Why it matters: Without one-time consumption, the agent could interpret a single approval as blanket permission for unlimited large trades. The since operator in Dogwood enables this: it checks that an approval event occurred and that no execute_trade response has occurred since that approval.

Pattern 6: Mutual Exclusion

What it enforces: The agent cannot buy and then sell the same security within the same session at a loss. The contradiction itself signals that something has gone wrong.

Why it matters: This pattern catches wash-trading behavior, circular logic errors, and adversarial manipulation. It generalizes to any domain where contradictory actions within a session indicate a fault — approving and denying the same claim, granting and revoking the same permission, creating and immediately deleting the same resource.

Pattern 7: Progressive Trust Decay

What it enforces: After 15 minutes without advisor interaction, the agent loses access to write operations. Read-only operations remain available. The advisor can re-engage at any time to restore full access.

Why it matters: If the human walks away, the agent naturally converges toward read-only behavior. This prevents extended autonomous operation from accumulating unchecked risk — an especially important pattern for agents that run on long-lived sessions or that operate in regulated environments where human oversight is a compliance requirement.

For organizations navigating the intersection of agent governance and regulatory compliance, our EU AI Act Enforcement Playbook covers how these patterns map to the high-risk provisions that went live on August 2, 2026.

Architecture: How Temporal Policies Fit into AgentCore

Understanding where temporal policies sit in the AgentCore stack is essential for architects designing production agent deployments. Here is the request flow:

1. Agent issues a tool call — whether through MCP, agent-to-agent communication, or model inference — routed through AgentCore Gateway.
2. Rate limits are applied first. Per-user, per-target, and multi-dimensional rate-limit configurations are evaluated before any policy logic. Even if a request is ultimately denied by policy, it consumes its rate-limit bucket.
3. The policy engine retrieves the session’s trajectory state — the bounded sequence of prior events identified by principal and session ID.
4. Each temporal policy evaluates the current request against that history. Deny-by-default semantics apply: forbid overrides permit, identical to Cedar.
5. If all policies permit, the request proceeds. If any forbids, the request is denied and logged with the full decision context.
6. On successful execution, the action and its result are appended to the trajectory state for future evaluations.

Key architectural details for production deployments:

• Session scoping: Every request carries an x-amzn-bedrock-agentcore-policy-session-id header. You decide what constitutes a session — a single conversation, a multi-step task, a longer workflow. AgentCore combines the session ID with the end user’s identity, so different users with the same session ID get separate trajectories.
• 24-hour look-back window: Trajectory events older than 24 hours are automatically pruned. All temporal conditions use relative time (sliding windows), though absolute-time operators (e.g., daily quota resets at midnight) are on the roadmap.
• Policy changes invalidate sessions: When policies are updated, existing sessions are invalidated. This ensures every session is evaluated against the current policy set with the expected event schema.
• Pricing: The first 100 temporal policies per policy engine are included in the existing per-authorization-request price. No separate SKU.

For organizations that recently migrated from Bedrock Agents Classic, our Bedrock Agents Classic Sunset Migration Guide covers the AgentCore transition. Temporal policies are a natural next step after completing that migration.

Dogwood vs. the Alternatives: Where Does This Fit?

Temporal policies are not the only approach to agent governance. Here is how Dogwood compares to the alternatives architects are using today.

The key differentiator is the combination of stateful evaluation and perimeter enforcement. Prompt-based guardrails are stateful in the sense that the LLM sees conversation history, but they are probabilistic and bypassable. Application-layer middleware can be stateful, but it runs inside agent code where bugs or prompt injection can circumvent it. Dogwood runs at the gateway — the agent cannot reach the tools without passing through the policy layer, regardless of what it tries.

Microsoft’s Copilot Studio August 2026 rebuild introduced its own multi-agent orchestration and governance features, and the broader industry is converging on the idea that agent governance belongs at the infrastructure layer, not the prompt layer. But Dogwood is the first to publish an open-source formal specification grounded in temporal logic — which matters for enterprises that need verifiable, auditable guarantees rather than best-effort controls.

The MCP Connection: Generating Policies from Tool Manifests

Dogwood includes a tool to generate the action schema directly from an agent’s MCP tool manifest — one action per tool, mapped onto a template that models the identities the agent authenticates as. This is a significant practical detail: if your agent already exposes tools over the Model Context Protocol, Dogwood can read that manifest and scaffold the policy skeleton automatically.

This MCP integration means temporal policies are not AWS-exclusive in design, even if AgentCore is the only managed runtime today. The Dogwood reference implementation (Apache 2.0) can parse any MCP-compatible tool manifest. Organizations running agents on other infrastructure could, in principle, build their own Dogwood evaluation layer — though AWS explicitly notes that the reference interpreter is intended for exploration and testing, not production use. Teams running it outside AgentCore would need to handle trusted event histories, tenant isolation, and data retention themselves.

What Dogwood Cannot Do (Yet)

Dogwood today verifies safety — what must not happen. It does not yet verify liveness — what must happen. The roadmap includes:

• Absolute-time operators: Every window today is relative (sliding). Many real rules need non-sliding windows — a daily quota that resets at midnight, a “before end of business” deadline. These require wall-clock boundaries rather than backward-looking durations.
• Liveness properties: Rules like “an approval must eventually be followed through,” “a started task must reach a terminal state,” or “a resource that was opened must be released.” These require future-looking operators, which MFOTL already models but Dogwood has not yet exposed.
• Multi-agent orchestration policies: As work spreads across cooperating agents, governance needs shift from single-agent trajectories to ensemble properties — who may hand off to whom, which agent holds a lock, whether the group is making progress.
• Automated reasoning for temporal policies: Cedar supports powerful automated reasoning analysis (proving that two policies never conflict, or that a given principal can never reach a resource). Dogwood’s temporal conditions do not yet support these tools — a trade-off AWS acknowledges is appropriate for agent governance but not for all use cases.

Practical Implications for RPA and Automation Teams

For organizations with existing RPA investments — whether in UiPath, Automation Anywhere, or Blue Prism — Dogwood signals a shift in how automation governance is implemented. Traditional RPA governance relies on process definitions (the workflow itself constrains what happens in what order) and orchestrator-level permissions (who can run which process). As these platforms add agentic capabilities — where the agent decides its own next action at runtime — the RPA governance model needs the same trajectory-aware enforcement that Dogwood provides.

Concrete takeaways for automation architects:

• If you are building agents on AWS: Start with the seven patterns. Implement workflow sequencing and output-to-input integrity first — they catch the most common failure modes (hallucinated arguments and skipped prerequisite steps). Add budget caps and human-approval gates before any agent touches financial or PII-sensitive tools in production.
• If you are building agents on other platforms: Study the Dogwood specification as a design reference, even if you implement enforcement differently. The seven patterns are platform-agnostic concepts — the governance gap they address exists on every agent runtime.
• If you are evaluating agent platforms: Add “trajectory-aware authorization” to your evaluation criteria. Ask whether governance runs at the infrastructure perimeter (tamper-proof) or inside agent code (bypassable). This is now a table-stakes question for production agent deployments.

Getting Started with Dogwood

For teams ready to implement:

1. Review the Dogwood language guide: The official documentation walks through the full language with practical examples.
2. Explore the GitHub repo: The dogwood-policy/dogwood repository contains the reference parser, validator, and interpreter under Apache 2.0.
3. Start with AgentCore Policy: If you are already running agents through AgentCore Gateway, temporal policies are available now. The first 100 policies per engine are included in existing pricing.
4. Read the AWS tutorial: The Securing AI agents with temporal policies blog walks through the full banking agent example with implementation details.

FAQs

Is Dogwood only for AWS? Can I use it with agents on other platforms?

Dogwood is open source under Apache 2.0, and its specification is platform-agnostic. The reference interpreter can parse MCP tool manifests from any compatible agent. However, the production-grade managed runtime — where event histories, tenant isolation, and policy evaluation are handled for you — is currently only available through Amazon Bedrock AgentCore. Running Dogwood outside AgentCore requires building your own infrastructure for trusted event storage and evaluation.

How is Dogwood different from just adding guardrails to my system prompt?

System prompt guardrails are probabilistic — they depend on the LLM following instructions, which prompt injection can bypass. Dogwood policies are deterministic — they run at the infrastructure perimeter, outside the agent’s reasoning loop. The agent cannot see, modify, or circumvent them. This is the difference between asking an agent to govern itself and enforcing governance on the agent externally.

Do I need to rewrite my existing Cedar policies to use Dogwood?

No. Every valid Cedar policy is a valid Dogwood policy. You can add temporal conditions alongside existing policies without migration. The two coexist — Cedar handles your point-in-time authorization, and Dogwood handles the sequence-aware checks.

What happens when an agent’s tool call is denied by a temporal policy?

The denial is returned to the agent through the normal AgentCore Gateway response path, and the full decision context (which policy denied the request and why) is logged. The denied request is still recorded in the trajectory state — which matters for policies that count requests rather than responses.

How do temporal policies handle concurrent tool calls from the same agent?

This is explicitly addressed in the Dogwood design. Rate-limiting and budget-cap policies should reference ::request events, not ::response events. Summing only completed responses creates a concurrency loophole where an agent fires many simultaneous requests before any resolves. Summing requests catches in-flight operations.

Key Takeaways

• Point-in-time authorization is insufficient for AI agents. Agents decide at runtime which tools to call, in what order, with what arguments — creating governance gaps that stateless access control cannot address.
• Dogwood is the first open-source temporal policy language for agent governance. Built on Metric First-Order Temporal Logic (MFOTL), it extends Cedar with temporal operators that evaluate the current request in the context of session history.
• Perimeter enforcement is the key architectural principle. Policies run at the AgentCore Gateway, outside agent code — making them tamper-proof against prompt injection, hallucination, and code bugs.
• Seven governance patterns ship on day one: workflow sequencing, output-to-input integrity, data freshness, cumulative budget caps, human approval with one-time consumption, mutual exclusion, and progressive trust decay.
• The concurrency loophole is real. Rate-limiting policies must sum requests (including in-flight), not just completed responses, to prevent agents from bypassing limits through parallel tool calls.
• Dogwood integrates with MCP. Action schemas can be generated directly from MCP tool manifests, making adoption straightforward for agents already using the Model Context Protocol.
• The roadmap includes liveness, absolute time, and multi-agent orchestration — extending governance from “what must not happen” to “what must happen” and from single-agent to ensemble properties.

References

1. Brooker, M., Tassarotti, J., & Tristan, J.-B. (2026, August 6). Introducing Dogwood: runtime verification for AI agents. AWS Open Source Blog.
2. Eichenberger, S., Gordon, N., & Trucksaess, P. (2026, August 6). Securing AI agents with temporal policies in Amazon Bedrock AgentCore. AWS Machine Learning Blog.
3. Lardinois, F. (2026, August 6). Your AI agent’s next tool call may be valid but wrong. AWS’s Dogwood promises to fix that. The New Stack.
4. AWS. (2026, August 6). Announcing temporal policies and rate limiting in Amazon Bedrock AgentCore. AWS What’s New.
5. AWS. (2026, August 6). Control agent behaviors and cost beyond a single action: new capabilities in Amazon Bedrock AgentCore. AWS Machine Learning Blog.
6. AWS. (2026, August 7). Amazon Bedrock AgentCore adds memory, policy, and harness in AWS GovCloud (US-West). AWS What’s New.
7. Dogwood Policy Language. (2026). Reference parser and interpreter. GitHub (Apache 2.0).
8. Dogwood Language Guide. (2026). Official documentation.