AI agents are changing the authorization problem. Traditional authorization evaluates a request based on the identity, resource, action and context available at that moment. That model remains essential, but autonomous agents introduce a new dimension: what the agent has already done, why it is doing it, and whether its behavior continues to align with the intended task.

An agent may invoke multiple tools, access sensitive data, make decisions based on previous actions and trigger downstream workflows. A request that appears safe in isolation can look very different when evaluated in the context of the agent's broader trajectory.

This is why AWS's introduction of Dogwood, an open-source policy language for runtime verification of AI agents, is significant. Dogwood extends the Cedar model with temporal policy capabilities that allow authorization decisions to reason over an event trace. AWS has also integrated Dogwood with Amazon Bedrock AgentCore Policy, bringing this capability directly to the agent's tool-call boundary. We see this as an important evolution in authorization.

The next generation of authorization needs to account not only for what an agent is allowed to do, but also who is acting, what the agent intends to accomplish, how it is behaving and what has happened before - and enforce those controls consistently across the enterprise. That is where Reva fits.

What Dogwood brings to agent authorization

Cedar established a strong foundation for deterministic, policy-based authorization, and it is core to Reva. We use Cedar for authorization within our platform and deeply value our partnership with AWS. Dogwood extends that model by allowing policies to incorporate information from an agent's previous actions.

Instead of evaluating only:

      Is this request allowed?

a policy can now reason about questions such as:

      Has this happened before?

      How many times has it happened within a given window?

      How much value has already been transferred?

      Did the required approval occur before this action?

This matters because agent behavior is inherently sequential. The security significance of an action can depend on what happened earlier in the workflow.

Dogwood therefore represents an important shift from point-in-time authorization toward history-aware authorization.

From a policy language to an enterprise authorization control plane

A policy language defines how an authorization rule is expressed and evaluated. An enterprise authorization architecture needs to manage much more: the policy lifecycle, from authoring and versioning to approval, testing, certification and deployment, as well as the identity and contextual data required to make runtime decisions.

This is the role of an authorization control plane: providing a centralized layer for managing policy and authorization across the enterprise while allowing enforcement to occur where and how it is needed.

This becomes increasingly important as authorization expands beyond traditional applications to include AI agents, non-human identities, APIs, data and infrastructure. Enterprises need a consistent way to govern authorization across these environments without requiring every use case to adopt the same policy language or enforcement model.

This also means the control plane must work across the authorization models enterprises already use. Cedar, OPA and Zanzibar-based approaches address different authorization requirements, from policy-based decisions to complex relationship-based access. The control plane should bring these models together rather than force enterprises to standardize on a single one.

Reva adds intent and behavior to runtime authorization

For AI agents, identity and history are only part of the runtime picture. An agent can have valid credentials, access an authorized tool and still take an action that is inconsistent with the user's original intent or with the expected behavior of the workflow.

This creates two additional dimensions for runtime authorization:

• Intent — Is the agent staying aligned with its original objective, or is its intent drifting?

• Behavior — Is the agent's sequence of actions consistent with the intended task and expected behavior?

Reva brings these signals into the runtime authorization decision, evaluating identity, action, resource and contextual attributes together with intent, behavioral trajectory and runtime risk.

This moves authorization beyond static entitlement checking toward continuous, context-aware runtime control.

Making temporal authorization manageable

As authorization policies become aware of an agent's trajectory, policy management also needs to evolve. Enterprises need to understand not just what a policy decides for an individual request, but how it behaves as an agent moves through a workflow.

This creates an opportunity for trace-based policy analysis. Proposed policies can be evaluated against recorded or synthetic agent trajectories to understand how authorization outcomes change as the workflow progresses. Security and IAM teams can test temporal conditions, assess potential impact and identify unintended outcomes before deploying a policy.

This is particularly important for agent authorization, where a policy change can affect not just an individual action but an entire sequence of actions.

Human approval or HITL becomes part of runtime authorization

Agentic workflows also create a more dynamic relationship between authorization and human oversight. An action may require approval based on its risk, context, value or the agent's preceding behavior. Temporal policy provides a useful mechanism for expressing conditions such as requiring a qualifying approval event before an action can proceed.

In practice, enterprise workflows can take different forms. An action may be denied and retried after approval, held while approval is pending, or suspended and resumed asynchronously once approval is granted.

The important shift is that human approval becomes part of the runtime authorization workflow, rather than simply another reason for an action to be denied.

This becomes increasingly important as agents move from recommendations to executing high-value and high-impact actions on behalf of users.

One authorization architecture across humans, applications and agents

Agentic AI should not require enterprises to create a separate authorization stack. The same organization may already have authorization policies governing human users, applications, APIs, microservices, data and infrastructure, and those controls now need to extend to AI agents and non-human identities. A modern authorization architecture therefore needs to support multiple authorization models and enforcement patterns while providing a consistent layer of governance.

That means enterprises can use:

• Cedar and Dogwood where AWS-native and temporal authorization are appropriate.

• OPA-based policies where general-purpose policy evaluation is required.

• Zanzibar-style relationship-based authorization for complex many-to-many access relationships.

Reva brings these authorization domains together through a common control plane, while Reva Trust Gateway brings identity, intent, behavior, context and risk into runtime decisions across these environments.

The value is not forcing every use case into one policy language or enforcement model. It is bringing heterogeneous authorization into one governed architecture.

The future is continuous authorization

As agents become more autonomous, authorization is evolving from point-in-time decisions toward continuous runtime evaluation. That means accounting for the broader context of an action - who is acting, what they are trying to accomplish, what has happened before, and whether their behavior remains aligned with that intent.  

Reva builds on this evolution with an enterprise authorization control plane that connects policy, identity, relationships, intent, behavior, context and runtime enforcement across applications, agents and cloud-native infrastructure.

The goal is simple: continuously determine whether an action is appropriate, not just whether it is permitted.

That is the authorization challenge of the agentic enterprise.

References

AWS Open Source Blog: Introducing Dogwood: Runtime Verification for AI Agents
https://aws.amazon.com/blogs/opensource/introducing-dogwood-runtime-verification-for-ai-agents/