AWS Dogwood: Trajectory-Aware
Agent Authorization

AI agents behave fundamentally differently from traditional applications: they decide at runtime which tools to call, with which arguments, and in what order. That flexibility makes agents both capable and hard to control — one tool call may be safe in isolation but harmful in the context of the preceding call, such as after reading from an untrusted source. AWS open-sources Dogwood to move authorization from stateless to trajectory-aware.

Why Static Access Control Falls Short

Before AI agents, it was generally sufficient for access controls to treat each action as an independent event; applications relied on deterministic business logic to enforce ordering and data freshness. Agents break that assumption. Their runtime flexibility means: an agent calls a lookup_customer tool, hallucinates a different account number than returned, and passes it to transfer_funds which moves money to the wrong account; a runaway agent executes dozens of trades in a loop because nothing tracks cumulative exposure over the limit; an agent both approves and denies the same insurance claim within seconds.

Each individual tool call in these scenarios passes a stateless policy check. The problem only becomes apparent when you look at the agent's trajectory — the ordered sequence of actions in a session. That is the core gap static controls cannot catch.

Dogwood and Cedar: Extension, Not Replacement

Dogwood builds on Cedar. Cedar is the open-source authorization language AWS contributed to the CNCF as a sandbox project in late 2025; it already powers AgentCore Policy for stateless checks: deciding whether a user or agent may call a refund tool with a given set of arguments. Dogwood takes this a step further — it can also account for earlier events: whether somebody approved the refund, how much the agent has refunded in the past hour, or whether it previously called a given tool.

Critically, Dogwood does not replace Cedar but extends it. Any existing Cedar policy is also a valid Dogwood policy, so teams do not have to rewrite their current rules. For temporal policies, Dogwood translates the history-dependent condition into a Cedar context field; in the reference implementation, Dogwood fills that field from the event history before Cedar makes the authorization decision.

Tamper-Proof Enforcement at the Gateway Perimeter

Temporal policies run at the AgentCore Gateway perimeter, outside the agent's own code. Because the agent cannot intercept or manipulate the policy logic on the gateway, these protections cannot be bypassed regardless of model behavior, prompts, or bugs in the agent code. AgentCore Gateway routes MCP tool calls, agent-to-agent calls, and model inference calls through a single endpoint, giving temporal policies one consistent place to reason about an agent's behavior over time across all three call types.

The policy engine works as follows: when the gateway receives a tool call, it queries the trajectory state for actions, inputs, and outputs relevant to the policies being evaluated; evaluates each temporal policy against the current request in the context of prior events in the customer-defined trajectory; then returns a deterministic ALLOW or DENY decision and logs the full context. Temporal policies deny by default and forbid wins over permit — consistent with existing AgentCore Policy security defaults.

Seven Typical Policy Patterns

AWS's private-banking portfolio agent example demonstrates seven temporal policy patterns:

Workflow sequencing — require one tool to be called before another to verify standard operating procedure adherence. Output-to-input integrity — require that the current call's argument exactly matches a prior tool's output, preventing hallucination or substitution between steps. Data freshness — require a data lookup within a time window to prevent decisions based on stale information.

Cumulative budget caps — track cumulative financial exposure in a session and reject once it exceeds the risk limit. Human approval before privileged actions — block destructive or sensitive tool calls until an explicit human approval event is recorded in the trajectory. Mutual exclusion — prevent an agent from both approving and denying the same matter within seconds. Progressive trust decay — automatically tighten permissions when an agent operates without human engagement.

Adoption Challenges: The Cost of Statefulness

Dogwood is more expensive to run than Cedar because it is stateful: it must retain and search event records, and evaluation time can depend on the length of that history. The included open-source reference interpreter is meant for exploring and testing the language, not for use as a production authorization engine.

For teams who want to adopt the open-source project immediately, AWS notes a series of engineering requirements: provide trusted timestamps, authenticate events, keep field and action names consistent, store traces durably, log authorization decisions, isolate histories between tenants, and establish a retention policy because tool-call histories can contain sensitive data. For the open-source release, the harder question is whether the event history is complete and trustworthy enough to use for authorization.

References:

• AWS ML Blog: Securing AI agents with temporal policies in Amazon Bedrock AgentCore
• The New Stack: AWS's Dogwood promises to fix the valid-but-wrong tool call
• AWS Documentation: Temporal policies in AgentCore
• AWS Documentation: Policy in Amazon Bedrock AgentCore