AWS open-sources Dogwood runtime verification and ships AgentCore governance controls

AWS open-sourced Dogwood, a policy language and runtime verification system aimed at the biggest risk in agentic systems: tool calls. Dogwood enforces dependable checks on an agent's proposed actions before they execute, giving developers deterministic guardrails rather than relying solely on the model's judgment. It's a notably safety-forward release given the week's backdrop of autonomous agents breaching systems in red-team tests.

Building on Dogwood, AWS added temporal policies to Amazon Bedrock AgentCore. These enforce workflow sequencing across multiple actions, prevent data fabrication, and require human approval for high-value operations — moving governance beyond single-action checks to entire agent workflows. AWS also introduced gateway rate limiting that caps per-user token consumption and connection traffic, addressing the runaway-cost risk of long-running autonomous agents.

Rounding out the governance push, AWS enabled routing of Bedrock Guardrails interventions into Amazon Security Lake, letting security teams query guardrail events (like blocked prompt-injection attempts) alongside identity, network, and application telemetry in a single investigative layer. AWS also backed Agent Plugins 1.0.0, a vendor-neutral open standard for portable agent extensions meant to end the cycle of rewriting MCP servers and agent skills per client.

The strategic thread is clear: as agents move to production, AWS is betting that control, verification, and auditability — not just capability — are what enterprises will pay for. The timing is pointed, landing the same week that AISI evals and OpenAI's Hugging Face disclosure showed agents can go rogue when safeguards are loose. The skeptical question is adoption friction: deterministic policy languages add developer overhead, and it remains to be seen whether teams invest in writing Dogwood policies or treat governance as an afterthought until an incident forces it.