The report
AWS released Strands Box in developer preview on October 7, combining macOS sandbox containment with a separate policy engine for AI agent actions. Its Apache 2.0 project mediates shell and Python execution, MCP calls and outbound HTTP requests through enforcement components outside the agent. The AWS announcement describes a design that can judge an operation in light of events the agent has already caused, rather than accepting the model's own account of what it intended.
Dogwood rules can depend on a destination, request method, resource path and action history. AWS's example counts successful HTTP 200 responses for Slack posts over ten minutes, which is not the same as counting every attempted message. The egress gateway can attach credentials only after it authorizes the outbound request; the agent sees placeholders rather than the real token. These mechanisms help separate the agent's choice of tool from the privileges used to carry it out.
The documented gap is event coverage
AWS explicitly says a file path granted directly through box.toml can be opened by the agent without that read entering the Dogwood policy history. The path is still subject to the operating-system sandbox. But a temporal rule such as 'after reading customer data, block HTTP' cannot reason from that missing read event. Reads through the governed interpreters are observed differently from direct grants, so route selection changes which earlier actions the policy sees.
The interpreters and brokers also enlarge the trusted computing base because they execute outside the confinement used for the agent. An implementation error in one of those components is a different possibility from the documented history gap, and the announcement does not demonstrate a general escape. Initial support is macOS; Linux support is planned rather than established in this release.
The Strands Box Case records both the proposed enforcement design and its limits. The decisive validation is to hold a policy constant while varying how the same file is accessed and verifying that the resulting external effects are actually denied, including when an authorized remote service makes a secondary request.