Dogwood: Extending Policy Engines for Temporal Logic in Agent Workflows
AWS has open-sourced Dogwood, a policy language extending Cedar to govern sequences of agent tool calls. Unlike Cedar, Dogwood supports temporal conditions, allowing policies to evaluate an agent's event history and enforce constraints across a series of actions. This innovation addresses complex authorization challenges in AI agents and distributed systems where sequential or concurrent actions need to be regulated.
Read original on InfoQ ArchitectureThe Challenge of Stateful Authorization in Agent Workflows
Traditional policy engines like AWS Cedar are designed for stateless authorization, evaluating each request independently. This approach simplifies auditability and automated reasoning but falls short in scenarios where authorization decisions depend on a sequence of past actions. AI agents, by their nature, compose actions into workflows, necessitating policies that can understand and enforce constraints across a history of tool calls. Dogwood emerges to fill this gap, offering a mechanism to introduce temporal logic into policy enforcement for these complex, multi-step operations.
Dogwood's Temporal Policy Extension
Dogwood extends Cedar by introducing a "when temporal" clause that can read an agent's event history. This history includes details of tool call requests and their outcomes, such as input arguments and the requesting principal. The core innovation lies in translating these temporal conditions into Cedar context fields, which are populated by an interpreter from the event history before Cedar makes a decision. This allows for policies that can enforce rules like "get approval before acting" or "stay under a running total."
- formerly: checks if something happened within a window.
- count_within: counts occurrences within a window.
- count_distinct_within: counts distinct values within a window.
- sum_within: calculates a running total within a window.
- bind operator: names an aggregate for comparison against the current request.
Concurrency and Correctness Traps
A critical aspect highlighted by AWS is the potential for concurrency to defeat poorly designed temporal policies. A rate limit based on response events instead of request events can be bypassed by concurrent requests. This problem, familiar in distributed systems, means that policies must be carefully designed to account for asynchronous agent behavior and interleaved operations, emphasizing the need for robust event logging and trusted timestamps.
Architectural Considerations and Trade-offs
Implementing temporal evaluation with Dogwood requires stateful tracking of events, which can impact evaluation time based on event log length. Crucially, temporal conditions do not support the automated reasoning analysis tools provided by Cedar, meaning policy sets utilizing them lose formal analyzability. This trade-off between expressive temporal logic and formal verification is a key design decision. The underlying infrastructure demands trusted, authenticated event logs, durable storage for traces, decision logging, and strict tenant isolation, essentially requiring a robust and secure event streaming and storage system.