AWS releases Strands Box: an AI agent sandbox based on Dogwood policies

AWS released the open-source sandbox Strands Box as a developer preview under the Apache 2.0 license, combining OS-level isolation with fine-grained policies to constrain AI agent behavior. The Box embeds the previously open-sourced policy language Dogwood and its local evaluation engine, making allow or deny decisions at multiple execution points including network egress, the Python interpreter, the Shell interpreter, and the MCP server proxy, with execution points sharing event history so rules can depend on the agent's prior actions. For example, a policy can limit the agent to sending at most 3 messages to Slack every 10 minutes, returning HTTP 403 with the rule ID and description when denied. The Box is configured via two files, box.toml and policy.dw; the egress gateway can inject real credentials on the agent's behalf, with the agent only receiving placeholder tokens.