Strands Box controls both access and tool use
Two levels of control
On 7 October 2026, AWS launched Strands Box in developer preview. It combines operating-system containment with Dogwood policies governing an agent’s actions.
Permission also depends on context
A sandbox limits what a program can reach. An action rule can specify what it may do with an accessible resource. For a diagnostic agent, reading logs and changing configuration therefore deserve separate permissions.
A useful pilot would begin with three scenarios: an allowed read, a forbidden modification and attempted exfiltration after reading a sensitive file. It would compare the expected decision, the operation actually blocked and the retained record. This examines the real boundary rather than configuration syntax alone.
Check which paths are covered
Operations outside policy interception points do not enter the same history. Direct access and tool paths therefore need mapping before protection is attributed to the entire workflow. Preview status calls for a bounded evaluation with test data and explicit rejection criteria.
Editorial retrospective: event dates are stated in the text.