# AI use cases for Box (strands-agents/box) Repo: [strands-agents/box](https://github.com/strands-agents/box) | Use cases: 4 | Page: https://dedupedai.com/use-cases/strands-agents-box/ Strands Box is an open source Rust sandbox engine that restricts what AI agents can execute, read, write, and reach on the network. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Run a coding agent inside a restricted Box sandbox: https://dedupedai.com/use-cases/strands-agents-box/run-coding-agent-in-sandbox/ - Keep API keys away from an agent with credential injection: https://dedupedai.com/use-cases/strands-agents-box/keep-api-keys-out-of-agent/ - Audit every policy decision an agent made: https://dedupedai.com/use-cases/strands-agents-box/audit-agent-policy-decisions/ - Embed Box in a Rust application as a library: https://dedupedai.com/use-cases/strands-agents-box/embed-box-in-rust-app/ ## How to run a coding agent inside a restricted Box sandbox with Box Repo: [strands-agents/box](https://github.com/strands-agents/box) | Difficulty: Intermediate | Time: 60 minutes | Basis: From the README Start an agent in a Box sandbox whose file, program, and network access you set in config. **Who it is for:** A developer on a Mac with Apple silicon who wants an AI coding agent to work on local files without open access to the machine or network. **The problem:** An agent with unrestricted shell and network access can read secrets, change files outside the project, or call hosts you did not intend. **The outcome:** The agent runs in an OS sandbox with direct grants set in Box.toml and checked operations decided by policy.dw. ### Steps 1. Confirm you have a Mac with Apple silicon and macOS 15 or later. 2. Run `curl -fsSL https://raw.githubusercontent.com/strands-agents/box/main/download.sh | sh` 3. Run `./box-core/box --version` to confirm the binaries unpacked into ./box-core. 4. Edit Box.toml to set the agent command and direct file and network grants, and edit policy.dw to set rules for operations Box checks. 5. Follow the getting-started guide in docs/user/getting-started.md to run the Box. ### Prompt to paste into your agent ```text Using the strands-agents/box repository, download the binaries with its download.sh script, then write a box.toml that gives read access only to . Expected output: `./box-core/box --version` prints a version string and the box starts with the configured grants reported at startup. Verify that the agent cannot read a file outside . ``` ### Caveat Box is in preview and currently runs locally only on macOS with Apple silicon, so Linux users must wait for planned support. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/strands-agents-box/run-coding-agent-in-sandbox/ ## How to keep API keys away from an agent with credential injection with Box Repo: [strands-agents/box](https://github.com/strands-agents/box) | Difficulty: Advanced | Time: 90 minutes | Basis: From the README Let the egress gateway add API credentials to permitted requests so the agent never sees them. **Who it is for:** A team lead who wants an AI agent to call paid or private APIs without handing the agent the raw secret. **The problem:** Putting API keys in an agent's environment or prompt lets the agent leak them, log them, or reuse them outside the task. **The outcome:** Permitted requests are authenticated by the gateway with configured API credentials or AWS SigV4 signing, and the agent does not receive the underlying secrets. ### Steps 1. Read the security model in docs/user/security.md. 2. Read the policy guide in docs/user/policy.md to write permit rules for the API hosts and paths you allow. 3. Add the API credentials and the allowed request rules to your Box.toml and policy.dw as the guides describe. 4. Run the Box and send a permitted request from the agent to the allowed host. 5. Check the decision records to confirm the request was permitted and that the agent's own environment holds no key. ### Prompt to paste into your agent ```text In the strands-agents/box repository, read docs/user/security.md and docs/user/policy.md, then configure credential injection for in box.toml and policy.dw. Expected output: a permitted request to succeeds and the agent's environment does not contain the API key. Verify that a request to a host not in a permit rule is denied. ``` ### Caveat The README says the gateway injects configured credentials but does not give the exact config keys, so confirm them in the guides before relying on this. Risk, credentials: Store real API keys only in the locations the Box security docs describe and test with throwaway keys first. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/strands-agents-box/keep-api-keys-out-of-agent/ ## How to audit every policy decision an agent made with Box Repo: [strands-agents/box](https://github.com/strands-agents/box) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README Read the OTLP JSON decision records to see what Box allowed and denied during a run. **Who it is for:** A security reviewer who needs proof of what an AI agent tried to read, run, or reach. **The problem:** Without a record of allow and deny decisions, it is hard to tell whether a policy works or what an agent attempted. **The outcome:** A file of decision records that shows each checked operation, its allow or deny result, and the rule behind it. ### Steps 1. Run the Box as described in the getting-started guide. 2. Run `cat /private/telemetry/records.jsonl` to open the default decision record file. (inferred, check the README) 3. Find a denied operation and note which forbid or missing permit caused it. 4. Adjust policy.dw and run the Box again to confirm the change in the records. ### Prompt to paste into your agent ```text In the strands-agents/box repository, run the box with a policy.dw that forbids outbound requests to , then open /private/telemetry/records.jsonl. Expected output: a JSON Lines record showing the denied request to . Verify that a request to an allowed host appears as permitted. ``` ### Caveat The README gives the default record path but not the record field names, so read the records to learn the format before writing any parser. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/strands-agents-box/audit-agent-policy-decisions/ ## How to embed Box in a Rust application as a library with Box Repo: [strands-agents/box](https://github.com/strands-agents/box) | Difficulty: Advanced | Time: 90 minutes | Basis: From the README Call strands_box::run from your own Rust host process to start a sandboxed workload. **Who it is for:** A Rust developer building a host application that must launch an AI agent inside a Box sandbox. **The problem:** A host app needs to start an agent under Box enforcement without shelling out to a separate CLI and losing control of the process. **The outcome:** Your application runs one Box workload in its own process and receives the exit code when the run finishes. ### Steps 1. Clone the repository with `git clone https://github.com/strands-agents/box.git` 2. Run `cargo build --release -p strands-box -p strands-box-containment` from the cloned folder. 3. Add the strands-box package from crates/box as a dependency of your Rust application. (inferred, check the README) 4. Call `strands_box::run("/absolute/box.toml".into(), Vec::new())` before starting application threads or loading secrets. 5. Ship the matching Box helper binaries beside your host application. ### Prompt to paste into your agent ```text Using the strands-agents/box repository, link the strands-box package in crates/box into a Rust host app and call strands_box::run with an absolute path to . Expected output: the function returns an exit code after the agent finishes. Verify that a second run call in the same process fails. ``` ### Caveat The README says only one Box workload per host process is supported and later run calls fail even after a first failure, so design the host around a single call. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/strands-agents-box/embed-box-in-rust-app/