AWS releases local policy engine for AI-agent tool calls

AWS has released Dogwood Local Engine, an open-source library that developers can embed in AI-agent software to check proposed tool calls against rules about earlier events and when they happened. The engine returns an allow-or-deny decision rather than blocking the action itself, The Register reported on October 1.

AWS gives the example of a coding agent using Git to upload code changes. A policy allows that action only if the most recent test run passed and that pass occurred within the previous 15 minutes. An older pass, or a pass followed by a failed test run, would not satisfy that rule.

From policy language to embedded engine

AWS published Dogwood, the open-source language used to define these policies, in August. The new release makes the engine that evaluates those policies directly embeddable in agent software. Written in the Rust programming language, the library can sit inside an agent harness or gateway—the software that manages the agent’s access to tools.

Enforcement remains the responsibility of that surrounding software. AWS says it must intercept every tool call, submit a request event to the engine and run the tool only if the engine returns an allow decision. Embedding the library alone does not enforce the rules.

According to AWS’s description, the engine records tool-call events in order and writes each log entry to disk before evaluating the applicable policy. That stored history survives a system crash or restart, so the engine can retain the earlier events needed for its time-aware checks.

Performance claims and an unanswered concurrency question

AWS reports tests simulating sessions lasting from five minutes to 12 hours. At the 12-hour mark, policy evaluation took around 20 microseconds with a 15-minute window—the period of past activity the rule considers. With a 24-hour window, evaluation took about six milliseconds. These are AWS’s reported evaluation times, not independent measurements of the complete tool-call process.

The engine uses a lock to permit only one event submission at a time, holding that lock until policy evaluation finishes. The Register nevertheless questioned how incorrect enforcement would be prevented if simultaneous submissions included one meeting the passing conditions and another causing a failure. The publication said AWS had not answered its inquiry before the October 1 report was published.