AWS Introduces Strands Decider 2B and Strands Box for AI Agent Development

AWS has introduced two open-source projects for AI agent development: Strands Decider 2B, a small model designed to make decisions within agent workflows, and Strands Box, a sandbox for controlling agent execution. Both projects address different aspects of building agents that use tools, execute code, and interact with external systems.

Strands Decider 2B is a two-billion-parameter model designed to select between predefined options rather than generate lengthy text responses. It supports tasks such as model routing, tool selection, classification, guardrails, and context management. Instead of asking a general-purpose language model to generate an answer, developers can provide a set of choices and receive a decision with confidence scores.

The model is based on Qwen3.5-2B, with its language-model head replaced by a pointer head that scores candidate answers. It uses a rank-16 LoRA adapter for fine-tuning. AWS has released the model weights, training data, and scripts, allowing developers to run and modify the model locally.

According to AWS, Strands Decider 2B achieved a median decision latency of approximately 115 milliseconds on an NVIDIA RTX 3090 and 153 milliseconds for small tasks on an Apple M3 MacBook. The company also evaluated the model using JevBench, reporting 72.3% accuracy across 231 public tasks for its v19 checkpoint. Developers can install the strands-decider package and use its command-line interface or integrate the model into Strands agents.

The second project, Strands Box, is available in developer preview and provides an isolated environment for executing AI agents. It combines operating-system-level isolation with Dogwood, an open-source policy language that defines which actions an agent can perform. The sandbox supports shell commands, Python execution, MCP tools, filesystem operations, and network access.

Strands Box uses kernel-enforced isolation to route agent interactions through a policy layer. Developers can allow or deny actions based on their content and execution history. For example, a policy can require an agent to pass tests before pushing code to a repository or restrict the frequency of external API calls. These controls operate outside the language model, reducing reliance on prompt instructions to enforce execution boundaries.

AWS says Strands Box can work with different models and agent frameworks, whether running locally or in cloud environments. This allows developers to introduce execution policies without replacing their existing agent architecture.

Strands Decider 2B competes with TypeSafe AI's Jev, another specialized model designed to make structured decisions without generating lengthy responses. Both support classification, routing, and tool selection, returning confidence scores alongside their decisions. The main difference is deployment: Strands Decider 2B is open source and can run locally, while Jev is available through a managed API. AWS evaluated Strands Decider using JevBench, although the published results do not establish a direct performance advantage over Jev.

Strands Box addresses problems also handled by container-based sandboxes, Firecracker microVMs, and hosted agent execution environments. While conventional sandboxing primarily restricts filesystem, process, and network access, Strands Box adds policies based on tool arguments and previous actions. This allows developers to define conditions that must be satisfied before an agent executes specific operations.

Early developer feedback has focused on the practical limitations of integrating small decision models into agent workflows. In a hands-on tutorial, AWS Community Builder Yuuki Yamashita reported that:

Strands Decider 2B could prevent an agent from making an unsupported weather-tool call.

GitHub discussions have also identified issues involving concurrent requests, Apple Silicon compatibility, and cold-start latency, highlighting areas developers may need to evaluate before using the model in production.

AI Builder Dipen Vaja commented on X:

I'd rather an agent hit a wall mid-run than finish a bad path. AWS open sourced Strands Box today: a kernel sandbox that routes shell, Python, tools and network through one policy layer, so a rule can block outbound HTTP after the agent reads a customer file.

Together, Strands Decider 2B and Strands Box extend the Strands ecosystem beyond agent orchestration into decision-making and execution control. The projects provide separate components for selecting agent actions and enforcing restrictions on how those actions are executed.