Dogwood Policy Python SDK

Python SDK and PyO3 binding for the Dogwood policy language. Dogwood supports fine-grained authorization decisions that depend on history or patterns of events over time, then lowers policies back to Cedar for evaluation.

For full documentation, see dogwood-py.abhishek-tiwari.com.

⚠️⚠️⚠️ Current Dogwood reference interpreter is not intended for production use; therefore, this Python SDK and PyO3 binding is experimental in nature.

Note: This is an unofficial Python SDK and port for Dogwood Policy. Support is provided on a best effort basis with community help.

Install

pip install dogwood-py

Optional extras:

pip install "dogwood-py[examples]"        # FastAPI and general examples
pip install "dogwood-py[strands]"         # Strands integration and shopping-agent example
pip install "dogwood-py[examples,strands]"

The package installs as dogwood:

from dogwood import native

assert native.available()

What It Provides

The public API follows the Rust dogwood-language lifecycle:

1. Build a ServiceSchema and PolicySchema.
2. Parse and lower policy source into a LoweredPolicySet.
3. Validate it.
4. Feed Event values to a stateful Authorizer.

The native path uses PyO3/maturin to call the Rust Dogwood reference implementation for schema-backed lowering, validation, trace replay, augmented Cedar schema export, and authorization. A temporary pure-Python fallback remains only for limited schema-less examples.

The Python SDK includes a PolicyEnforcer wrapper with mode="enforce" and mode="log_only" for rollout and audit behavior. Dogwood still evaluates the policy; the SDK mode controls whether a denied decision blocks the operation or is reported as would_have_denied.

dogwood-py also provides optional Strands Agents support. Dogwood policies can be attached as Strands interventions so tool calls are checked before execution, with typed outcomes such as proceed, deny, guide, confirm, and transform.

Strands integrations use the same SDK-level enforce and log_only modes on top of the Rust Dogwood policy decision.

Documentation

• Installation
• Getting Started
• Native Rust Binding
• Strands Agents Integration
• PolicyEnforcer API
• Examples
• API Reference

Dogwood language documentation is available at dogwood-policy.github.io/dogwood.

Examples

Checked-in examples are documented at Examples. After installing the package and optional dependencies, run examples directly:

python -m examples.api_usage

python -m examples.cli

python -m uvicorn examples.fastapi_simple.app:app --host 127.0.0.1 --port 8000

python -m examples.strands_shopping_agent.agent --user alice

Development

make setup
make develop
make test
make docs
make build

Useful targets:

• make docs-ci installs docs-only dependencies and builds Sphinx HTML docs.
• make docs-watch serves live-reloading docs at http://127.0.0.1:8001.
• make perf-test runs the opt-in native-vs-Python replay regression check.

The docs-only Cloudflare Pages build command is:

make docs-ci PYTHON=python

Build output directory:

docs/build/html

Current Scope

Rust-backed operations cover schema-backed lowering, validation, authorization, and trace replay. The Python fallback is temporary and schema-less only. The intended end state is to remove it once the Rust-backed SDK objects cover the same ergonomic surface.