AWS launched Strands Box in developer preview on October 7, describing an open-source sandbox for AI agents that combines operating-system isolation with policies written in Dogwood. The project is licensed under Apache 2.0. Its current support is for macOS on Apple silicon; Linux support is planned, not already delivered.
The two layers have different jobs. Operating-system containment limits what an agent can reach, while policy controls permitted actions through network egress, Shell and Python interpreters, and a broker for Model Context Protocol servers. AWS describes the system as independent of a particular agent application.
Those checkpoints share a history of actions. A policy can therefore use earlier activity when deciding whether to allow a later action, rather than checking each request in isolation. AWS's examples include limiting the number of Slack updates over a time window. Example limits are configuration choices, not universal defaults for every Box deployment.
The network gateway can attach configured credentials to permitted requests. The agent can receive a placeholder while the gateway supplies the real value or signs an AWS request. This is a feature of configured credential routes, not proof that every secret in a developer's environment is automatically protected.
A key limit is direct filesystem access. Files granted directly to the agent in box.toml remain bounded by operating-system containment, but those reads and writes do not enter Dogwood's policy history. AWS says files that need policy checks should instead be reached through the interpreters. Treating every file operation as policy-covered would overstate the current design.
This is an early developer preview, not a guarantee that an autonomous agent is safe. AWS identifies a wider trusted code base as a design trade-off, and lists easier setup, more operating-system support and packaging for deployed agents as future work. Developers still need to define, inspect and test their access grants and policies.