Dogwood vs Cedar for AgentCore Temporal Policy

Quick answer

Cedar expresses point-in-time authorization over a principal, action, resource, and current context. Dogwood builds on that model and adds temporal expressions that can reason about earlier events in a bounded session.

For AgentCore Policy, this is an extension path rather than a forced migration. AWS says Dogwood is compatible with Cedar and supports existing Cedar policies. Keep stable stateless rules; add Dogwood temporal conditions only where workflow history changes the authorization decision.

Capability comparison

Capability	Cedar-style stateless rule	Dogwood temporal rule
Principal, action, resource	Yes	Yes
Current request context	Yes	Yes
permit and forbid	Yes	Yes
Deny by default	Yes	Yes
Forbid overrides permit	Yes	Yes
Match a prior session event	No	Yes
Require an event within a window	No	Yes
Count or sum bounded events	No	Yes
Correlate prior output with current input	No	Yes

Dogwood does not turn policy into orchestration. The engine still returns an authorization decision; the agent and tools still execute the workflow.

Core temporal patterns

AWS and the Dogwood guide document these building blocks:

• formerly within: require a matching event earlier in a declared window;
• since within: reason about events after an anchor event;
• count: limit matching invocations in the bounded history;
• sum: constrain cumulative numeric values in that history;
• request/response/error selectors: match the event kind your rule actually needs;
• field correlation: bind prior inputs or outputs to the current request.

Do not copy an example before checking its action schema, event fields, resource binding, time window, and current-request inclusion semantics.

A low-risk adoption path

1. Inventory existing Cedar policies and their owners.
2. Keep baseline role, tool, resource, and input rules unchanged.
3. Identify one workflow where prior evidence is necessary.
4. Define a narrow policy session and required identity propagation.
5. Version the action and event schema.
6. Add one temporal rule with explicit allows and denials.
7. Validate and replay versioned traces with the Dogwood tooling.
8. Observe in LOG_ONLY before promoting to ENFORCE.
9. Plan for active-session invalidation on policy changes.

This sequence makes it easier to distinguish a language error, schema mismatch, missing event, session problem, and actual authorization defect.

Testing checklist

Test more than the expected allow path:

• no matching permit;
• matching permit plus matching forbid;
• missing session ID;
• wrong principal or resource;
• predecessor recorded as error rather than response;
• wrong output-to-input value;
• event just inside and outside the time window;
• self-referential count at the exact threshold;
• new session with empty history;
• session reused after policy update.

The Dogwood project documents CLI validation and trace replay, while AgentCore provides policy evaluation metrics and spans. Both help verify implementation; neither decides whether the business rule itself is appropriate.

Frequently asked questions

What is Dogwood?

Dogwood is an open-source policy language for agent and tool governance. It builds on Cedar’s authorization model and adds session-aware temporal expressions.

Do existing Cedar policies need to be rewritten for Dogwood?

AWS says Dogwood is compatible with Cedar and supports existing Cedar policies, so point-in-time rules can remain while temporal conditions are added where needed.

Which temporal operators does AgentCore document?

AWS documents patterns including formerly within, since within, and bounded count and sum aggregations. Use the current Dogwood guide for complete syntax and validation rules.

Does Dogwood make policy testing optional?

No. Validate the schema and policy, replay expected allow and deny traces, use LOG_ONLY where appropriate, and review production observability before enforcement.

Related guides

• AgentCore temporal policies guide
• Temporal versus stateless policy
• Session ID and 24-hour window
• Temporal policy planner

Official sources

• The Dogwood Guide
• Amazon Bedrock AgentCore: Temporal policies
• AWS temporal policies implementation guide

Source check: August 8, 2026. Validate current language syntax, schemas, runtime behavior, AgentCore quotas, and enforcement modes before production use.