AgentCore Natural-Language Dogwood Policy Authoring Guide

Quick answer

Use AgentCore Policy Authoring when the organization already has clear rules in prose and wants help translating them into Dogwood. First reduce the source document to atomic permitted or restricted actions. Then provide the exact AgentCore Gateway or MCP tool schema, review every generated and unsupported rule, test denial behavior, and keep a human owner responsible for semantic approval.

The authoring service is a translator and bounded compiler. It is not a policy designer, compliance approval, deployment, or proof that enforcement matches business intent.

Prepare a translatable rule document

Separate rules from background, examples, goals, and commentary. Each rule should identify:

• the principal or allowed identity claim;
• the exact tool action and resource scope;
• current input constraints;
• any prior request, response, approval, count, sum, or freshness condition;
• the allowed or forbidden outcome;
• the owner who can approve changes.

Avoid ambiguous terms such as “large,” “recent,” “trusted,” or “sensitive” unless the document defines measurable fields and thresholds. If a rule requires a global user, tenant, account, or billing total, keep that control in a durable service rather than implying a policy-session aggregate is global.

Bind the real tool contract

AWS says Policy Authoring uses schema information derived from the agent’s MCP tool manifest. The schema establishes the tool names, input arguments, return values, available identity claims, and supported Guardrails checks that a generated policy can reference.

Review the schema before generation. Remove deprecated tools, narrow fields, document optional values, and confirm types and resource identifiers. A syntactically valid rule anchored to an outdated or overbroad schema can still authorize the wrong action.

Review the authoring output

For every generated rule, compare prose and Dogwood side by side:

Review field	Question
Principal	Is the identity claim available, scoped, and least privileged?
Action and resource	Does the rule name the exact Gateway target and resource?
Event kind	Does it rely on a request, successful response, or error?
Correlation	Are current inputs bound to the smallest trusted prior fields?
Window	Is the temporal window short enough for the source’s volatility?
Aggregation	Does count or sum include the current request as intended?
Guardrails	Is the check supported, and what happens on failure or timeout?
Deny behavior	Is missing, stale, mismatched, or unsupported evidence denied?

Maintain a separate list of unsupported rules. Route each one to a tool invariant, durable quota, human workflow, monitoring control, or rewritten formal rule. Silence is not an allow decision.

Test before enforcement

Start with observation or LOG_ONLY where supported. Run a matrix covering allowed baseline, denied principal, wrong resource, missing predecessor, failed predecessor, stale evidence, mismatched output, reused approval, threshold boundaries, new session, changed schema, Guardrails timeout, and rollback.

Inspect the authorization trace and the downstream tool result. A correct policy decision does not prove that the tool was idempotent, the data was accurate, or the business transaction settled correctly.

Use the Policy Authoring review checklist for the final handoff. Compare generated and handwritten Dogwood when the rule set is small.

Data geography and lifecycle boundary

AWS documents that Policy Authoring selects an inference Region within the request’s geography. Stored data remains in the Region where the request originated, while input prompts and output results may be processed outside that Region within the same geography over AWS’s network.

Verify live Region and geography availability, IAM, logging, retention, sensitive-data rules, model behavior, quotas, pricing, and account requirements. Do not generalize Policy Authoring availability from another AgentCore feature or Region.

Official sources

• AWS: Authoring Dogwood policies from natural language
• AWS: Writing policies in natural language
• AWS: Authoring temporal policies

Source check: August 23, 2026. Recheck authoring availability, supported rules, schemas, identity claims, Guardrails checks, geography, IAM, quotas, and enforcement modes before use.