AWS Open-Sources Strands Decider and Box for Agent Decisioning and Safety

AWS Open-Sources Strands Decider 2B (a 2-billion-parameter decision model) and Strands Box (an execution sandbox), addressing lightweight decision-making and secure execution in agentic workflows, respectively. Decider 2B employs a pointer head combined with LoRA fine-tuning, focusing on multi-option scoring and routing. It achieves sub-100ms latency on consumer-grade hardware and attains 72.3% accuracy on JevBench.

It supports model routing and tool selection; provides deterministic decisions with confidence scores; and offers out-of-the-box CLI capabilities along with integration into Strands agents.

This content is suitable for AI engineers, agent architects, and MLOps engineers.

AWS has launched two open-source projects aimed at AI agent development: Strands Decider 2B, a small model designed for making decisions within agentic workflows, and Strands Box, a sandbox for controlling agent execution. These two projects address distinct challenges encountered when building agents capable of using tools, executing code, and interacting with external systems.

Strands Decider 2B is a 2-billion-parameter model designed to select from predefined options rather than generating lengthy text responses. It supports tasks such as model routing, tool selection, classification, guardrails, and context management. Instead of relying on general-purpose language models to generate answers, developers can provide a set of options and receive a decision result accompanied by a confidence score.

The model is based on Qwen3.5-2B, where the language modeling head has been replaced with a pointer head used for scoring candidate answers. It is fine-tuned using rank-16 LoRA adapters. AWS has released the model weights, training data, and scripts, allowing developers to run and modify the model locally.

According to AWS, Strands Decider 2B achieves a median decision latency of approximately 115 milliseconds on an NVIDIA RTX 3090 and around 153 milliseconds on an Apple M3 MacBook when handling small tasks. The company also evaluated the model using JevBench, reporting an accuracy of 72.3% across 231 public tasks for its v19 checkpoint. Developers can install the strands-decider package, use its command-line interface, or integrate the model into Strands agents.

The second project, Strands Box, is currently in developer preview and provides an isolated environment for executing AI agents. It combines OS-level isolation with Dogwood. Dogwood is an open-source policy language used to define which operations an agent is permitted to execute. The sandbox supports shell commands, Python execution, MCP tools, file system operations, and network access.

Strands Box uses kernel-enforced isolation mechanisms to route agent interactions through a policy layer. Developers can allow or deny operations based on their nature and execution history. For example, policies can require that an agent must pass tests before pushing code to a repository, or limit the frequency of calls to external APIs. These control mechanisms operate outside the language model, reducing reliance on prompt instructions for enforcing execution boundaries.

AWS states that Strands Box can be used with various models and agent frameworks, regardless of whether they run locally or in the cloud. This allows developers to introduce execution policies without replacing their existing agent architectures.

Competitors to Strands Decider 2B include TypeSafe AI’s Jev, which is similarly a model specialized for making structured decisions rather than generating verbose responses. Both support classification, routing, and tool selection, providing confidence scores alongside decision results. The primary difference lies in deployment: Strands Decider 2B is open-source and can be run locally, whereas Jev is provided via a hosted API. While AWS used JevBench to evaluate Strands Decider, the published results do not demonstrate direct performance superiority over Jev.

The problems addressed by Strands Box can also be handled by container-based sandboxes, Firecracker microVMs, and managed agent execution environments. Traditional sandboxes primarily restrict file system, process, and network access, while Strands Box adds policies based on tool parameters and historical operations. This enables developers to define conditions that an agent must satisfy before performing specific actions.

Early developer feedback has primarily focused on the practical limitations of integrating small decision models into agentic workflows. In a hands-on tutorial, AWS Community Builder Yuuki Yamashita noted:

Strands Decider 2B can prevent agents from calling unsupported weather tools.

GitHub discussions have also identified issues related to concurrent requests, Apple Silicon compatibility, and cold-start latency, highlighting aspects that developers may need to evaluate before deploying the model in production environments.

AI Builder Dipen Vaja commented on X:

I’d rather have an agent hit a wall mid-run than execute all the way down a wrong path. AWS open-sourced Strands Box today: a kernel-level sandbox that routes Shell, Python, tools, and network access through a single policy layer, allowing rules such as “after the agent reads customer files, prohibit outbound HTTP requests.”

Together, Strands Decider 2B and Strands Box extend the Strands ecosystem from agent orchestration into the domains of decision-making and execution control. The two projects provide independent components for selecting agent actions and constraining how those actions are executed.