AWS has launched two open-source tools designed to give developers tighter control over AI agent behavior, according to a report published this week on InfoQ. Strands Decider 2B is a compact model built to choose between predefined options within agent workflows, while Strands Box provides a sandbox that isolates and governs agent execution. Together, the projects tackle separate challenges in building agents that call tools, run code, and connect with outside systems.
Strands Decider 2B is a two-billion-parameter model designed to pick from a set of choices rather than produce lengthy text outputs. It handles model routing, tool selection, classification, guardrails, and context management, returning decisions alongside confidence scores. Built on Qwen3.5-2B, the model swaps the standard language-model head for a pointer head that ranks candidate answers and uses a rank-16 LoRA adapter for fine-tuning. AWS published the model weights, training data, and scripts, letting developers run and adjust the model on their own hardware. The company measured a median decision latency of roughly 115 milliseconds on an NVIDIA RTX 3090 and 153 milliseconds for smaller tasks on an Apple M3 MacBook. Testing with JevBench yielded 72.3% accuracy across 231 public tasks for the v19 checkpoint. Developers can install the strands-decider package and use its command-line interface or embed the model into Strands agents.
Strands Box, available in developer preview, delivers an isolated environment for running AI agents by combining operating-system-level isolation with Dogwood, an open-source policy language that specifies which actions an agent may perform. The sandbox handles shell commands, Python execution, MCP tools, filesystem operations, and network access. According to the report, Strands Box routes agent interactions through a policy layer using kernel-enforced isolation, allowing developers to permit or block actions based on their content and execution history. For instance, a policy can mandate that an agent pass tests before pushing code to a repository or limit how often external API calls are made. These controls sit outside the language model, reducing dependence on prompt instructions to set execution boundaries. AWS states that Strands Box works with different models and agent frameworks, whether running locally or in the cloud, enabling developers to add execution policies without overhauling their current agent setup.
Strands Decider 2B competes with TypeSafe AI's Jev, another specialized model built to make structured decisions without generating long responses. Both handle classification, routing, and tool selection, delivering confidence scores with their decisions. The key distinction is deployment: Strands Decider 2B is open source and runs locally, while Jev is offered through a managed API. AWS tested Strands Decider using JevBench, though the published results don't show a clear performance edge over Jev. Strands Box addresses issues also managed by container-based sandboxes, Firecracker microVMs, and hosted agent execution environments. Unlike conventional sandboxing, which mostly limits filesystem, process, and network access, Strands Box adds policies based on tool arguments and past actions, letting developers define conditions that must be met before an agent executes certain operations. Early feedback has centered on practical integration challenges. AWS Community Builder Yuuki Yamashita noted in a hands-on tutorial that Strands Decider 2B could stop an agent from making an unsupported weather-tool call, while GitHub discussions have flagged problems with concurrent requests, Apple Silicon compatibility, and cold-start latency. AI Builder Dipen Vaja commented on X that he'd "rather an agent hit a wall mid-run than finish a bad path," pointing to Strands Box as a kernel sandbox that routes shell, Python, tools, and network through one policy layer so a rule can block outbound HTTP after the agent reads a customer file. Together, Strands Decider 2B and Strands Box push the Strands ecosystem beyond agent orchestration into decision-making and execution control, offering separate components for choosing agent actions and imposing limits on how those actions are carried out. Organizations that deploy agents in production will need to weigh the operational complexity of maintaining local decision models and policy engines against the flexibility and transparency these tools promise.