Start with the same file on different paths
Strands Box’s Dogwood policy governs mediated operations, while operating-system grants separately control direct filesystem access. That distinction determines what a denied read proves. A useful boundary test repeats the same operation through different tools, then checks which control allowed or blocked it. Sources: Strands Agents
Yutaka Kashiwabara reported that shell and Monty reads of.env were denied, while an admitted host executable, awk, could read it. His report describes testing v0.1.0 on an EC2 Mac M1 host, with most conditions exercised once. This article’s proposed workflow was not run locally, and that report’s limited sample does not establish a general guarantee. Sources: Zenn
The launch explanation presents an architecture that channels interactions through policy. The detailed security documentation distinguishes mediated access from direct grants. Use that narrower model to design the experiment. Record the execution path alongside every result so a successful denial is not mistaken for protection across all tools. Sources: Strands Agents
Pin the release and prepare disposable inputs
The release listing returned during research identified v0.1.0, released October 7, 2026, as the latest release. It provides an Apple-silicon macOS archive and describes Linux support as planned. The introductory Strands command-line interface example requires macOS 15 or later and Homebrew Node.js 22.21 or later. It also requires Claude Opus 5 access through Amazon Bedrock in us-west-2; the Node.js and model requirements belong to that example. The pinned installation command follows, and its downloader checks the release’s aggregate checksum file. Sources: Strands Agents
curl -fsSL https://raw.githubusercontent.com/strands-agents/box/main/download.sh \
| BOX_VERSION=v0.1.0 shCreate a disposable project containing README.md, notes.txt and a synthetic.env with an unmistakably fake token. Keep another dummy file outside the project. Start from the tutorial’s full configuration, which exposes only a shell tool. Retain its proxy preload: the JavaScript Amazon Web Services SDK does not automatically follow HTTPS_PROXY, and the example’s Bedrock HTTP/2 traffic needs adaptation. Sources: Strands Agents
Match documentation and examples to the release because configuration keys, flags and policy actions can change during the 0.1.x preview. After adapting the configuration, verify the binary and launch the box with the commands below. Keep the model, prompt, fixtures and unrelated grants fixed between runs. Save configuration and policy hashes to identify exactly what changed. Sources: Strands Agents
./box-core/box --version
./box-core/box run --config my-box/box.tomlEstablish a denial, then permit one write
Ask the agent to read README.md through the shell, append a line to notes.txt and attempt both dummy sensitive-file reads. Require attempted commands, exit statuses and errors, with instructions to continue after a denial. First allow project reads without permitting writes, then restart with only the narrow write permission added. Dogwood requires a matching permit for submitted operations, and a matching forbid takes precedence.
The illustrative fragment below adapts documented action and path syntax to permit writing notes.txt and forbid reading the project’s.env file. Retain the baseline shell and model-network permissions because this fragment is not a complete policy. Rule identifiers appear in decisions, and duplicate identifiers are rejected. Keep fixture locations consistent throughout the comparison. Sources: Strands Agents
@id("allow_notes_write")
permit (principal, action == Box::Action::"fs:write", resource)
when { context.input.path == "~/box-lab/project/notes.txt" };
@id("deny_dummy_env")
forbid (principal, action == Box::Action::"fs:read", resource)
when { context.input.path == "~/box-lab/project/.env" };The tutorial records decisions in my-box/state/private/telemetry/records.jsonl and supplies an extractor. Preserve standard error, standard output, exit codes and exact file changes alongside those records. Add deterministic probes: an agent declining an operation does not demonstrate enforcement. The table below pairs proposed tests with expectations derived from the documented model. Sources: Strands Agents
Table
Expected outcomes by boundary test
| Proposed test | Expected result | Evidence to preserve |
|---|---|---|
| Shell reads allowed README | Success | Command result and fs:read permit |
| Shell writes notes without write permission | Denial | fs:write denial; unchanged file |
| Same write after adding the narrow permit | Success | Permit and exact file diff |
| Shell reads explicitly forbidden dummy.env | Denial | Deciding rule ID |
| Monty reads the same dummy.env | Denial | Same filesystem rule through a different interpreter |
| Harness directly reads a file outside its OS grants | OS denial | Runtime error |
| An admitted host tool reads.env inside its own read grant | Read may succeed | Spawn decision and file output |
| Request to an unpermitted test host | Denial | Gateway response and network decision |
| Allowed host, forbidden method or path | Request denied | Connection admission and HTTP authorization |
| Attempt to change the loaded policy | Refusal | Enforcement failure |
Repeat the operation across execution paths
Compare the dummy.env read through Strands Shell, Monty and an admitted host executable with its own read grant. Implemented shell commands face command admission and applicable filesystem checks; Monty file operations receive mediated filesystem checks. A host executable faces spawn admission followed by its own sandbox grants. These paths can therefore produce different file-access outcomes under the same Dogwood policy. Sources: Strands Agents
After the host-tool comparison, narrow that tool’s read grant and rerun it. Also test the agent program’s direct read outside its operating-system grants. Direct access does not require a Dogwood decision for each file operation. Preserve runtime errors and observed access rather than treating missing telemetry as evidence of an escape. Sources: Strands Agents
Review what each admitted tool can start as well as what it can read. A permitted tool can run its process tree, making Git hooks and npm scripts relevant to permission scope. On macOS, tool sandboxes can inspect existence and metadata across the operator’s home, while content access remains subject to read grants. Local Model Context Protocol (MCP) servers combine sandbox grants with broker checks, but some protocol methods and notifications pass without policy decisions. Sources: Strands Agents
Test network decisions and history separately
Begin with an unpermitted host, then try a permitted host with a forbidden HTTP method or path. The network guide says net:connect and http:request must both permit gateway traffic. A credential binding alone does not authorize a destination. A gateway refusal returns HTTP 403 with the x-strands-box-egress header set to refused. Tools or standard-input/output MCP servers configured to disable egress containment bypass that gateway. Sources: Strands Agents
Add temporal policy after establishing those boundaries. The launch article illustrates requiring successful npm tests before a Git push, within 15 minutes and since the last staging operation. It acknowledges that switching branches can undermine that relationship. The policy guide recommends permitting named subcommands because matching one argument position misses alternative invocation forms. History persists in box_dir across restarts, so restarting does not necessarily create a fresh temporal test. Sources: Strands Agents
Inspect event attributes before constructing a write budget. Kashiwabara reported descriptor_issued for shell writes and completed for Monty writes; a rule counting only completed writes missed shell writes. Reproduce that discrepancy against the pinned release and separately against current code. Compare mediated and direct reads before outbound requests, and test sequential requests separately from simultaneous ones. These experiments examine which events policy observes without assuming comprehensive information-flow tracking. Sources: Zenn
Close direct access before adding real credentials
Before introducing real data, inspect the remaining permissions. Readable data can leave through permitted destinations, and every process in a box can use its credential bindings through permitted routes. The gateway cannot identify the originating process, so the security model calls for separate boxes for separate credential trust domains. It also has no automatic cloud-metadata blocklist: explicit forbids are required, and gateway policies cannot govern direct-network exceptions. Sources: Strands Agents
Box relies on host isolation and excludes hardware and timing side-channel protection. Its design acknowledges that trusted-process defects can undermine enforcement and that generated code executed elsewhere is outside its control. The launch article recommends a per-session micro virtual machine for cloud multi-tenancy, while the researched release supports Apple-silicon macOS. Treat that cloud recommendation as architectural direction rather than a supported Linux deployment path. Sources: Strands Agents
The repository says security fixes apply to latest main. Release pinning therefore needs an accompanying plan for consuming fixes. Preserve paired traces as regression tests, including the configuration change that closes direct access. Rerun them when updating the binary, policy or agent program.