Dogwood Policy Python SDK

Contents

Dogwood Policy Python SDK#

Python SDK and PyO3 binding for the Dogwood policy language. Dogwood is a policy language for fine-grained authorization decisions that depend on history or patterns of events over time - not just a single request. It adds temporal conditions (since, formerly, once, aggregations) and information providers (computed guardrail facts) on top of Cedar policy syntax, then lowers everything back to Cedar for evaluation. Existing Cedar policies stay valid as-is. For information, read the Dogwood documentation.

Warning

Current Dogwood reference interpreter is not intended for production use; therefore, this Python SDK and PyO3 binding is experimental in nature.

Note

This is an unofficial Python SDK and port for Dogwood Policy. Support is provided on a best effort basis with community help.

GitHub Release GitHub Actions Test Workflow Status PyPI Version Python Wheels Python Versions GitHub Last Commit PyPI Status Conda Version License GitHub Downloads PyPI Downloads

The public API is modeled after the Rust dogwood-language lifecycle:

  1. Build a ServiceSchema and PolicySchema.

  2. Parse and lower policy source into a LoweredPolicySet.

  3. Validate it.

  4. Feed Event values to a stateful Authorizer.

This package uses PyO3/maturin to bind the Rust dogwood-language reference for schema-backed lowering, validation, and trace replay. The Python SDK also keeps a temporary pure-Python fallback only for source-tree examples that omit a full Cedar action schema. Schema-backed workflows require the native extension.

The SDK includes dogwood.PolicyEnforcer with enforce and log_only modes for rollout and audit behavior. Dogwood still evaluates the policy; the SDK mode controls whether a denied result blocks execution or is reported as would_have_denied. See dogwood.enforcement for the API reference.

dogwood-py also provides optional Strands Agents support. Dogwood policies can be attached as Strands interventions so tool calls are checked before execution, with typed outcomes such as proceed, deny, guide, confirm, and transform. See Strands Agents Integration for the integration API and Strands Shopping Agent for a runnable shopping-agent example.

Strands integrations use the same SDK-level enforce and log_only modes on top of the Rust Dogwood policy decision.

User Guide

Contents