Amazon Web Services (AWS) has launched an open-source tool named Strands Box, aimed at allowing developers to regulate AI agents' behaviors to enhance security as these agents increasingly interact with sensitive enterprise applications. Unveiled in a developer preview on October 7, Strands Box employs a combination of operating system isolation and customizable policy guidelines.
This tool is built for Macs equipped with Apple silicon, specifically running macOS 15 or later. At its core, Strands Box utilizes Dogwood, AWS's open-source policy language, alongside an evaluation engine that assesses the actions of AI agents. This framework enables the system to consider an agent’s past behaviors across various platforms, thus controlling future actions based on earlier activities.
To illustrate its functionality, AWS describes a scenario where an agent is tasked with monitoring a production incident. While it can send updates to a Slack channel, the tool can enforce restrictions—like allowing no more than three updates every ten minutes—to ensure communication remains effective and doesn’t overwhelm human users. This way, Box enforces limits without burdening the agent with remembering these constraints.
Strands Box supervises actions routed through supported shells and Python interpreters, along with its Model Context Protocol (MCP) broker. By default, its network gateway assesses outgoing requests against established policies, enabling designated credentials for secure transmissions without exposing sensitive data to the agent itself.
AWS's approach is designed to enhance control mechanisms that function independently from the AI agents themselves, thereby reducing dependence on inherent permission frameworks of individual systems. However, the true value of Strands Box may lie more in its practical application rather than the technology itself.
Pareekh Jain, CEO of Pareekh Consulting, pointed out that while Strands Box tackles significant security challenges, the technologies on which it is based are not particularly novel. However, the tool's primary strength is to simplify and standardize security enforcement across various AI frameworks.
Balancing Security with Functionality
Dogwood's policy framework has its limitations; it doesn't evaluate every action an agent might undertake. For instance, when files are accessed directly via an agent's built-in capabilities, they’re governed by the operating system's restrictions without undergoing scrutiny from Dogwood's engine.
AWS has also recognized that the shell and Python interpreters operate beyond the sandbox as part of a trusted process, thus expanding the array of components that the security of Strands Box relies on. Jain warns that while the additional security measures are beneficial, they could also lead to increased processing overhead and introduce new vulnerabilities.
According to Tulika Sheel, senior vice president at Kadence International, poorly conceived policies could either block essential agent functions or lead to unnecessary complexity. Conversely, overly lenient policies could still expose significant risks. Jain emphasizes the impossibility of preventing every potential harmful decision an agent might execute within its granted permissions, thus underscoring the need for Identity and Access Management (IAM), monitoring, and human oversight.
Expanding Strands Box's Reach
Looking ahead, AWS intends to extend Strands Box’s compatibility beyond macOS, aiming to allow developers to deploy AI agents with their associated policies across various platforms, such as Amazon Bedrock AgentCore, Amazon ECS, and Kubernetes. However, there’s currently no timeline for these advancements.
A shared policy layer could enable developers to focus on agent development while security teams enforce standard guidelines. Yet, Jain mentions that actual adoption will depend heavily on broader platform compatibility and the processing overhead introduced by policy enforcement. Sheel notes that while the open-source aspect may aid in adoption, enterprises will need convincing evidence of the tool's robustness in live environments before widespread implementation.
As AI agents continue to gain autonomy, understanding and regulating their behavior may soon be as essential to infrastructure as managing identity and access is today.
This article originally appeared on InfoWorld.
