Episode 215 - GluuFederation/identerati-office-hours GitHub Wiki
Title: Cedar Gets Temporal: Meet Dogwood
- Host: Mike Schwartz, Founder/CEO Gluu
- Guest: Marc Brooker, VP/Distinguished Engineer at AWS
Channels
Description
AWS’s new open source Dogwood project extends Cedar with temporal policies that govern what an agent can do based on what happened earlier. Dogwood can express rules like “approval must happen first,” “three failed logins and you're locked out,” or “don’t send data after accessing something sensitive.” It has the potential to bring formal runtime verification to agent behavior. In this episode, we’ll look at how Dogwood works, how it relates to Cedar and MCP, and whether temporal policy is becoming a necessary layer of AI authorization.
Homework
Takeaways
-
⚡ Temporal policy makes the PDP stateful. Dogwood can maintain session or durable state, and AWS’s production implementation compiles Dogwood policies to SQL to leverage transactions, concurrency control, durability, and auditability.
-
⚡ Dogwood trades some Cedar analyzability for expressiveness. Temporal logic, regex, macros, and other features expand what policies can express, while creating new challenges for formal reasoning and verification.
-
⚡ Authorization may need to govern future obligations, not just prevent bad actions. Temporal logic introduces concepts such as always and eventually—including requirements that something good must happen later, which Dogwood frames as liveness.
-
⚡ Policy governance becomes harder as policy languages get more powerful. The ultimate goal is still to answer simple questions—“Can my agent expose this data?”—with a crisp yes or no, even when many policies and engines are involved.
-
⚡ Dogwood allows three non-analyzable use cases: (1) Account-scoped temporal rules (account lockout after 3 wrong tries, credential-change cooldown). These need IDP cluster session sharing or lockout is gone. (2) Instance-scoped history ("max N tool calls per conversation"). Here local state is correct if the agent restarts, the conversation is over anyway. (3) Computed providers (regex/rhai over request field as context).