AWS debuts open-source policy sandbox for AI agents
AWS has introduced Strands Box, an open-source sandbox for AI agents that combines operating-system isolation with policy checks. It routes shell commands, Python code, MCP tool calls, and network traffic through checkpoints that consult the Dogwood policy engine, denying actions unless rules allow them. The developer preview runs on Apple silicon Macs, with Linux support planned, and can enforce limits such as requiring tests before git push or capping API spending.
AWS released Strands Box in developer preview for Apple silicon Macs, with Linux support planned. It relies on macOS Seatbelt for kernel-enforced isolation. Shell commands, Python code, MCP tool calls, and network traffic pass through four checkpoints that consult the Dogwood Local Engine.
The engine denies actions unless a rule permits them, and all checkpoints share one event history so policies can connect behavior across tools. The network gateway can swap placeholder tokens for real API keys and sign AWS requests. Files directly granted in box.toml are fenced by the OS and skip policy review.
Developers and organizations deploying autonomous coding or operations agents may gain stronger guardrails, potentially reducing accidental data exposure, destructive commands, or runaway API costs. Open-source availability could encourage broader experimentation and scrutiny, though added complexity and policy-authoring effort may limit adoption. If such sandboxes become common, they could shape how AI agents are trusted with sensitive tools, affecting security teams, auditors, and end users who rely on automated systems.