AWS launches Strands Box: Sandboxes that control what AI agents read and modify

AWS launched the Strands Box, a sandbox solution for AI agents that goes beyond execution isolation: instead of just locking the agent in a separate environment, it controls what it can read or modify on sensitive systems. The ad was posted in the AWS Open Source Blog and has Dogwood as the centerpiece, the layer that decides whether each agent action is authorized. The discussion comes at the moment when autonomous agents cease to be a demonstration and start operating with real access to internal files, credentials and APIs.

Strands Box: What goes beyond the ordinary sandbox?

A traditional sandbox solves the problem of "wrecked everything": container, virtual machine and operating system permissions prevent the agent from dropping the environment or escaping it. The Strands Box works on another layer. According to AWS, the proposal is to control what the agent can read or modify — that is, authorize specific operations within sensitive environments, and not just limit where it runs.

The difference is practical. Isolate says, "The agent stays here." Authorize says "the agent may consult this file, but do not change that". For those who put agents into production, the second problem is what usually causes silent incidents: nothing breaks, but a data is read, copied or overwritten without anyone having predicted it.

Dogwood at the Strands Box: Why did you become the center of the discussion?

The ad name already delivers the architecture: Strands Box is presented as "powered by Dogwood". Dogwood is the political component that evaluates the agent's actions and decides what goes on and what is blocked. Instead of incorporating rules into the agent's code, the idea is to describe permissions in a declarative way, outside the model, so that the policy is reviewable and auditable by those who did not write the prompt.

This separation between "what the agent wants to do" and "what he has the right to do" is the same principle that other market fronts have been adopting. Microsoft, for example, presented new zero trust tools to protect AI agents, with similar logic: identity and permission stay out of the model.

Strands Box and Brazilian devs: why does it matter?

For two specific reasons. The first is compliance: teams that handle personal data under LGPD need to be able to demonstrate who accessed what and based on which authorization. An agent with free access to internal bases is difficult to defend in audit; an agent with declared policies is easier to explain and review.

The second is adoption. AWS was expanding the tools of agents for corporate use — from managed agents in Amazon Bedrock to voice agents in Amazon Connect. If the Strands Box follows the Strands ecosystem pattern, it tends to arrive as an open source library, which reduces the barrier for Brazilian teams that do not have a dedicated AI security team.

What Strands Box doesn't solve in agent safety

Writing politics remains human work — and, poorly written, it gives a false sense of control. The sandbox restricts the agent's reach, but it doesn't validate if the decision he made makes sense. Nor does it replace observability: knowing which policy has been triggered and why is part of the problem, not an operational detail.

It is worth following project documentation to understand the format of policies, supported environments and how Dogwood integrates with the rest of the AWS stack before treating it as a single layer of defense.

Frequently Asked Questions about Strands Box

What is Strands Box, AWS?

It is a sandbox solution for AI agents that controls what each agent can read or modify in sensitive environments, going beyond execution isolation.

What is Dogwood?

It is the policy component that supports the Strands Box and evaluates the agent's actions to decide what is allowed or blocked.

Is the Strands Box open source?

The announcement was posted on AWS' open source blog within the Strands ecosystem. License details and the exact format of the policies should be checked in the original publication and in the project repository.