AWS Tool Stops AI Agents From Making Risky Moves

AWS's new tool, Dogwood, helps developers govern sequences of AI agent actions, preventing individually valid but collectively dangerous mistakes.

Amazon Web Services has released a new open-source tool named Dogwood to address a subtle but critical risk in AI agent development. According to reporting from The New Stack, the tool is a policy language designed to govern the *sequences* of actions an AI agent takes, rather than just evaluating each action in isolation. This new capability targets the problem where an AI agent can perform a series of individually permitted actions that, when combined, lead to an unintended or harmful outcome. AWS has also integrated Dogwood into its managed service, Amazon Bedrock AgentCore Policy, making it immediately available for developers building on its platform. The release signals a growing focus in the industry on creating robust safety and governance frameworks for increasingly autonomous AI systems.

Dogwood’s core innovation lies in its stateful approach to policy enforcement. Most traditional access control systems are stateless; they check if a single requested action, like an API call, is on an approved list. They have no memory of what happened before. Dogwood works differently by maintaining a memory, or state, of the agent's previous actions within a session. This allows developers to write much more nuanced and context-aware rules. For example, a rule could permit an agent to read a sensitive customer file but prohibit it from subsequently calling an external communication tool like an email API in the same workflow. This prevents logical but dangerous chains of events, such as an agent accessing private data and then exfiltrating it, even if both the “read” and “send” permissions are technically valid on their own.

This development is highly significant for developers, CTOs, and security teams building applications with AI agents. As these agents are granted more autonomy and access to powerful tools—from internal databases to public-facing APIs—the potential for complex, unforeseen errors grows. A simple allow-or-deny list for tools is no longer sufficient. Dogwood provides a more sophisticated layer of control that mimics human oversight, allowing for the creation of guardrails that understand context and history. This helps solve a major security headache and builds confidence in deploying agents into production environments where they interact with critical systems and sensitive data. It shifts the security posture from being reactive to proactively defining safe operational boundaries.

The business implications of tools like Dogwood are substantial. By providing a clear and powerful way to manage the risks associated with AI agents, AWS is lowering the barrier for enterprises to adopt more advanced autonomous systems. This could accelerate the use of AI agents in regulated or high-stakes industries such as finance, healthcare, and logistics, where the cost of an error is extremely high. Making Dogwood open-source is a strategic move that encourages broad adoption and could help establish it as an industry standard for agent governance, extending its influence beyond the AWS ecosystem. For businesses, this means a clearer path to leveraging AI for complex automation while maintaining stringent security and compliance controls, ultimately turning a potential liability into a reliable asset.

Dogwood addresses a critical flaw in AI agent security where a series of individually approved actions can lead to a dangerous outcome. It gives developers, security teams, and CTOs granular, stateful control over agent behavior, making it safer to deploy autonomous systems with access to sensitive tools and data.

By providing a robust framework for agent safety, Dogwood can reduce business risk and accelerate the adoption of AI agents in regulated industries. Its open-source nature promotes standardization, while its integration into Amazon Bedrock gives AWS customers a competitive edge in building reliable AI applications.