AWS Expands Natural-Language Policy Authoring for AI Agents in Amazon Bedrock AgentCore

What happened

Amazon Web Services has expanded Policy Authoring, an AI-driven tool inside Amazon Bedrock AgentCore that converts natural-language policy documents into Dogwood, an open-source formal governance language for AI agents. The update, detailed in a technical blog post from AWS, adds support for temporal and trajectory constraints — rules that depend on time windows, sequences of prior actions, or cumulative totals across a session — on top of the input-parameter restrictions the tool already supported.

Dogwood policies are enforced in real time by a Dogwood monitor embedded in the AgentCore Gateway, the routing layer through which agents call tools in Amazon Bedrock AgentCore. Previously, Policy Authoring could only translate natural-language rules into constraints on a tool call's input arguments. The new version can also generate policies for rate limiting, prerequisite steps, ordering of tool calls, and running totals — plus policies that invoke Amazon Bedrock Guardrails to screen free-form text for inappropriate content by semantic meaning rather than fixed keywords.

How it works

Policy Authoring takes two inputs: a natural-language document containing the rules (AWS recommends stripping out rationale and commentary, since the tool is described as "a translator rather than a summarizer") and a schema generated from the agent's Model Context Protocol (MCP) tool manifest, which supplies the exact tool names and argument types the generated policy must reference.

AWS's blog post walks through examples using a hypothetical retail-bank customer service agent with five tools: verify_identity, initiate_transfer, issue_refund, file_dispute, and request_approval. Sample translations include:

• Business-hours and amount caps: A rule limiting refunds to $2,500 or less during 9 AM–5 PM UTC becomes a single Dogwood permit statement with two when conditions checked against the current time and the amount input field.
• Time-bound prerequisites: A rule requiring identity verification within the prior 15 minutes for the same account becomes a temporal condition using a "formerly within 15m" operator that inspects prior session events.
• Cumulative caps: A rule blocking transfers once a 12-hour rolling total exceeds $50,000 becomes a Dogwood expression that sums the amount field across all initiate_transfer requests in the window and compares the total against the threshold.

Dogwood is described as default-deny, meaning any action not explicitly permitted is blocked, and a forbid statement always overrides a permit. AWS notes the translation defaults to summing all attempted transfer requests (rather than only successful ones) in the cumulative-cap example, calling this the "safer reading" when a policy document leaves ambiguity about failed attempts.

What this means

This is a feature expansion to an existing AWS product, not a new model release — there is no new set of weights or a version string to call via API. The significance is in the governance layer itself: as enterprises deploy AI agents that autonomously call tools like transfers, refunds, and approvals, the ability to express compliance rules as formal, machine-enforced constraints — rather than relying on the agent's own judgment or a human reviewing every action after the fact — addresses a real operational gap. Formalizing natural-language policy into a language like Dogwood also creates an audit trail: the generated policy can be inspected for whether it actually captures the intent of the prose it was translated from, which matters for regulated industries like banking. The catch is that autoformalization is only as good as the ambiguity resolution baked into the translator, as AWS's own example acknowledges when a policy document is silent on edge cases. Organizations adopting this will still need to review generated Dogwood policies rather than treat the translation as final.