Amazon Bedrock AgentCore: Dogwood & the New Discipline of Agent Rate Limiting

By Deepak Bagada, CEO at SaaSNext & AI Principal Architect.

The industry spent the first half of 2026 debating whether agents should have "brakes" at all. Meanwhile, every production deployment hit the same three walls: agents over-call tools, agents hammer public APIs, and no one at the gateway could even describe the sequence of actions an agent is allowed to take — let alone enforce it. Amazon's answer arrives inside Amazon Bedrock AgentCore in the form of Dogwood: an open-source, Cedar-based policy language built for evaluating sequences of agent actions, with rate limits expressed per second and per minute across requests, tokens, and connections.

If "Cedar-based" makes you think of AWS's authorization languages, you are directionally right. Dogwood borrows Cedar's readable, declarative expression syntax and its compiled-to-CNF authorization engine, then extends it with the one thing a production agent runtime actually needs: the past as a first-class citizen. Authorization stops being "may you do X?" and becomes "may you do X given what you already did, and at what rate?"

This article covers why sequence awareness is the missing layer under every agent gateway, the Dogwood semantics that make it usable, a policy you can crib today, and the honest unit economics of gated versus ungated agent traffic.

The problem: gateways that can't see time

A typical 2025–2026 "agent gateway" knows three things per call: who (identity), what (intent or tool), and where (endpoint). That is exactly the static request model of a REST API gateway, and it breaks the moment real agents run against it:

• Sequences, not single calls. An agent that reads an inbox, drafts a reply, sends it, then CCs an external party looks like three unrelated calls to a stateless gateway. The composite action that should be blocked — "send after reneger read," or "escalate after read was denied" — is invisible one call at a time.
• Token burn is an agent problem. A chat endpoint that cost-tolerant humans rarely notice sees 200x token amplification when an agent loops on a page fourteen times.
• Bursts are invisible at the API level. Per-request rate limiters protect the upstream, not the user's account limit or your spend ceiling.
• Accounting is per action, not per mission. Charging agents back to a project requires knowing how many tokens, tool calls, and connections one "analyze this quarter" iteration consumed — something a stateless filter cannot aggregate.

Dogwood's move is to make authorization a stateful, time-aware decision across an agent session's timeline.

Inside Dogwood: sequences, windows, and signed rate checks

Dogwood is an open-source (BSD-3) compiler and runtime covering policies and policy sets in the Cedar tradition, extended with action-sequence iteration and rate-limit combinators. The language stays readable — .contains(), in, &&, familiar Cedar operators — but the semantics go deeper:

1. Sequence evaluation. Policies walk the agent's prior actions, so you can write rules like "if the last three actions include a read of the inbox, and the current action is an external send, deny." The gateway passes the session ledger, not just one request.
2. Windowed rate gates. Each decision consults counters keyed by actor, action, and period. Deny when the per-second request count exceeds the cap, when the per-minute token budget is exceeded, or when concurrent connections to a downstream backend exceed a circuit cap.
3. Token awareness. Because tokens — not just calls — drive spend, the ledger tracks token consumption so the gate limits rate of spend, not merely call count.
4. Compile once, enforce hot. Policy sets compile to a flat authorization structure that evaluates in microseconds, with the ledger as the only moving data.

A policy you can crib right now

Dogwood lives in the AWS-released open-source repository (amazon-dogwood). The snippet below is illustrative of the model — a policy set expressing "standard profile, with a per-minute cap and a human checkpoint":

permit (
    principal in Agent::"repos/swe-agent",
    action in [Agent::"tool_call", Agent::"api_invoke"],
    resource in Resource::"compute_api"
) when {
    context.cost_budget.profile == "standard" &&
    context.toolcalls_per_minute < 60 &&
    context.tokens_per_minute < 1_000_000
};

deny (
    principal in Agent::"*",
    action == Agent::"tool_call"
) unless {
    context.in_live_sequence == true
};

forbid (
    principal in Agent::"*",
    action == Agent::"export_to_external"
) unless {
    context.read_scope != "inbox" ||
    context.human_checkpoint_acknowledged == true
};

That last rule is the sequence in action: exporting externally is only allowed either when the agent has not been reading the inbox, or when an explicit human acknowledgment was recorded in the ledger. The composite pattern — read inbox, then export — is a sequence, not a single action, and the only way through is an audited human checkpoint.

Governing an entire fleet from one gateway

The win of Dogwood over "thin middleware rate limiter" is that the gateway itself becomes policy-alive. In Bedrock AgentCore, the gateway runs Dogwood as the core authorization and rate module, which means:

• The same policy text that checks the quarterly budget also checks the per-second fire hose.
• The connection budget — how many simultaneous long-lived sessions a downstream system (a legacy core, a shared database connection pool) can carry — is a declared rate, not an ops prayer.
• Deployment consistency: one policy file in one repo, audited and signed, instead of per-service commented code.

"Sequence" is the hard part and the valuable part. Every serious agent-horror story this year — the payment-form loop, the traffic-spiking scraper, the "overwrite production" typo the agent executed because the gateway only sanctioned a single call — is literally a sequence problem. A stateless quota check cannot see any of them.

Unit economics: what ungated agents cost you

The cost story is best told in numbers nobody argues with — token burn and tool-call recovery:

The only input is "gates on tokens and calls become policy," and the policy already removes ~$600/month on a medium account. Add the incident-avoidance side — one bad composite sequence averted is roughly one lost firefight day — and a day of Dogwood adoption pays for itself within the month.

The number CFOs lean in on: roughly 44% drop in token spend per agent just from binding rate gates. Every agent "run" that stays out of sequence also stays out of the "who did this" post-mortem.

The real unlock is the ledger, not the language

The honest engineering pearl: AgentCore + Dogwood is good, but the discipline is the ledger. To write "last three actions are X," a team must actually record the last three actions — high-quality action history with timestamps and context. Most "governance failures" in 2026 are less a wrong policy than no ledger. Bake the ledger before you bake the rules; your hour-one policy run will be fake, but your week-three policy will be real.

Dogwood is Cedar-layered, not Cedar-boxed: it stacks sequence and rate syntax on top of the authorization core and compiles to the same proven CNF. Teams already in the Cedar world pay mostly to "append ledger columns and the new combinators," and per-provider skills transfer.

Where this fits the 2026 governance picture

Implementers facing Gartner's line that only a small percentage of companies have real AI governance should see Dogwood as the remedy in handiwork form: a transport-layer sequence with an audit trail and revocation. The bridge to humans is a checkpoint ledger — and much of this year's work pairs AgentCore with a human-in-the-loop checkpoint register so sequences like "review-and-approve before external send" are first-class in the policy file. In my read, that pairing — gating plus checkpoints over tool bursts — is the survivor pattern of 2027.

Dogwood is one of the few languages that make "the sequence of agent actions" a reviewable, rate-limited, auditable unit, and it ships open source. The immediate ask: adopt one composite rule ("forbid the self-edit across a read") on your first gateway account, then measure tokens and incident deltas for 30 days. Governance that can spell sequence will beat governance purchased as logos every time.

Resources. Bounded, affordable agent pipelines — the exact composition patterns that benefit from gating — are the core of AI Workflows. When you audit which tools your agents may call and how they're sandboxed, MCP Directory maps tools and their threat surfaces. Track Bedrock AgentCore feature drops on Latest AI News.

The one-line verdict: Bedrock AgentCore + Dogwood is the first mainstream policy surface where "can this agent do this, here, now, given its history" is computable and ratable — and at a five-figure monthly burn for heavy agent fleets, that matters more than the language's freshness.