Strands Box separates agent actions from policy enforcement, with a documented history gap

AWS Strands Box uses macOS operating-system containment alongside a Dogwood policy engine operated outside the agent process. Shell, Python, MCP and network gateway calls can be checked for concrete effects rather than relying on the model to honor its instructions. One policy can depend on earlier recorded events, such as blocking outbound connections after a sensitive read or limiting approved message sends within a time window. The network gateway may attach API credentials after a decision, keeping the real secret outside the agent environment.

The guarantee depends on which actions are observed. AWS explicitly says ordinary direct file access granted through box.toml remains bounded by operating-system containment but is absent from Dogwood event history. A temporal rule that assumes every sensitive read is visible could therefore miss a read performed through that direct allowance. AWS also places its interpreters outside containment, making them part of the trusted code. This is a documented architecture limitation, not an independently demonstrated escape from the product.

A temporal policy can be correct within its observed event stream while missing activity outside that stream. The AWS example that limits Slack posts counts HTTP responses with status 200, not merely attempted calls. By contrast, files opened directly through box.toml grants never produce Dogwood fs:read events. A rule that conditions future outbound access on a sensitive read therefore depends on routing the read through an instrumented interpreter. This is an observability contract between the file-access path and policy, not a bug that automatically means an untrusted agent can escape OS containment.