Source: AWS Machine Learning Blog — 2026-08-06
Summary
Amazon Bedrock AgentCore introduced Dogwood, a new open-source policy language and interpreter for governing AI agent behavior. Unlike typical allow/deny rules that evaluate one action at a time, Dogwood can reason about sequences of tool calls — enforcing things like a cumulative cost cap across a whole session, or requiring that an approval event happened earlier before a later action is allowed to run. Policies are enforced at the gateway perimeter, outside the agent's own code, so the agent can't route around them.
Key Takeaways
- Dogwood is a new open-source policy language and interpreter released as part of Amazon Bedrock AgentCore.
- It governs sequences of agent tool calls, not just isolated single actions — a fundamentally different evaluation model than typical allow/deny policy engines.
- It can enforce cumulative constraints, like a total cost cap across an entire agent session rather than a per-call limit.
- It can express ordering dependencies, such as requiring a prior approval event before a later action is permitted to execute.
- Policies run at the gateway perimeter, outside the agent's own codebase, specifically so the agent cannot bypass or work around its own guardrails.
Reel Script
Hook (~15-20s, 35-45 words) Most AI agent guardrails only ask one question: is this one action allowed, yes or no. That's a huge blind spot. AWS just released a policy language that instead asks: what has this agent already done — and it changes what's actually possible to enforce.
Core Concept (~45-90s, 105-200 words) Here's the gap Dogwood is closing. A typical policy engine looks at a single agent action in isolation — can it call this API, yes or no — and forgets everything the moment that check passes. That works fine for simple blocklists, but it falls apart for anything that depends on history. Say you want an agent's total spending capped at fifty dollars across an entire session. A single-action check can't do that, because by definition it only sees one call at a time — it has no memory of what already happened. Dogwood is built to reason about sequences instead of snapshots. It can track cumulative state, like running cost, across a whole session, and it can enforce ordering — for example, requiring that some approval step actually happened earlier in the sequence before a later, riskier action is allowed to fire. And crucially, this isn't a suggestion baked into the agent's own code — Dogwood runs at the gateway, the actual choke point the agent's calls pass through, so the agent has no way to skip the check.
Hands-On (~45-150s, 105-350 words) Compare the two models directly. Old way, single-action policy: the agent wants to call a payment API, the gateway checks "is this agent allowed to call the payment API at all" — yes — and lets it through. Do that ten times in a row and each check passes every time, even if the combined spend is way over budget, because nothing is tracking the running total. New way, with Dogwood: same payment API call, but now the policy is written against the sequence — "allow this call only if total spend so far this session, including this call, stays under fifty dollars." Now the gateway has to actually track state across every prior call in that session before deciding on the current one. Same idea applies to approval gates — a rule like "don't allow the deploy action unless an approval event already occurred earlier in this session" is structurally impossible to express with a stateless single-action check, because that check has no concept of "earlier." Dogwood makes that kind of sequence-aware rule a first-class thing you can write, and because it sits at the gateway rather than inside the agent's own logic, the agent itself has no path to skip past it.
Takeaway (~20-30s, 45-70 words) If your AI agent guardrails only check actions one at a time, they can't actually enforce a budget or a sequence, no matter how strict each individual rule looks. Dogwood is worth a look specifically because it moves the unit of enforcement from "one call" to "the whole session." Go check whether your own agent policies have that same blind spot.