Dogwood
Open policy language for governing AI agents and their tools: Cedar-style permit/forbid rules plus temporal conditions over an agent's recent actions.
Tags
Description
Dogwood extends Cedar with temporal clauses (since, formerly, once, windowed aggregations), so a rule can allow an action only if an approval happened within the last hour or cap calls per window. Information providers (Rhai scripts) inject computed facts. Policies lower to standard Cedar, with temporal fields filled in at runtime. The dogwood-policy/dogwood repo holds the grammar, a reference interpreter (not for production) and the dogwood CLI (format, validate, lower, replay); v1.1 released 2026-10-14. The separate Dogwood Local Engine is the authorization engine embedded in Strands Box. Released by AWS; Apache-2.0.
Related
- Strands Box: Open-source local agent sandbox from AWS's Strands team: OS isolation plus default-deny Dogwood policies over shell, Python, network and MCP calls, with credential injection.
- Strands Agents: Open-source, model-driven SDK and ready-made harness for building AI agents in Python and TypeScript, with MCP, multi-agent patterns, memory, guardrails, tracing and evals.
Sources
- https://github.com/dogwood-policy/dogwood
- https://dogwood-policy.github.io/dogwood/
- https://github.com/dogwood-policy/dogwood-local-engine
- https://aws.amazon.com/blogs/opensource/introducing-strands-box-ai-agent-sandboxes-powered-by-dogwood/
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)