AWS Dogwood: Temporal Guardrails for Agent Tool Calls

Every guardrail most teams put on an AI agent answers one question: is this single tool call allowed? Cedar, IAM, an allowlist in your MCP gateway. They all look at the request in front of them and nothing else.

That misses the way agents actually cause damage. No individual call is wrong. The order is wrong. The agent issues a refund it never got approved. It reads a confidential document and then emails an outside address. It fires forty small transfers in a minute because each one passed the per-call check.