Box

Enterprise content is what Box agents act on, and they write as well as read. They search, analyze and create files in Box Notes, Word, PDF, Excel and PowerPoint, with availability set across AI Home, Files and Hubs, and permissions gate every action. Box serves a Box MCP server so external platforms reach Box content, publishes an AI Studio API and a developer platform, and custom agents can query images and spreadsheets.

No integrations that reach systems outside Box, such as a CRM or a ticketing system, are documented; what the agents act on is content and the platform around it.

Sourcebox.com/agents, /ai/ai-studio (index copies); docs.box.com/en/box-ai/creating-and-configuring-agents; readread 2026-09-17

Multi step work is driven by instructions and modes rather than a workflow builder. Custom instructions can enforce step by step workflows ("first analyze, then propose, then act"), direct the agent to favor certain tools when several are available, and specify structured output.

Pro Mode supports "advanced agent behaviors such as recursive reasoning and enhanced document or video analysis", and Expanded Mode lets queries exceed standard limits. The Box Agent completes multi step tasks across content, locating files, analyzing large document sets and generating new files, iterating in agentic loops.

There is no workflow surface with branches and retries, and no versioning is documented. Whether Box Automate workflows can invoke an agent step was not established.

Sourcedocs.box.com/en/box-ai/creating-and-configuring-agents; box.com/agents (index copy); readread 2026-09-17

Agents are grounded in specific, permission aware content. An agent's Knowledge setting "binds the agent to specific files, or Hubs for reference". Knowledge sources are referenced with @mentions in custom instructions, with explicit priority rules when they conflict (a single source of truth, or ProductSpecs highest, ReleaseNotes second and FAQ lowest), which Box says "ensures agents remain grounded in authoritative sources".

Box AI "pulls information only from the document you loaded in preview" and tells the user when a question falls outside it. AI Studio "reduces hallucinations by grounding agents in specific, admin-approved files or Hubs", responses cite their sources, and custom agents can query images and spreadsheets. Hubs act as bindable, maintained knowledge scopes over the customer's content.

How Hub contents refresh is not described.

Sourcedocs.box.com/en/box-ai/creating-and-configuring-agents; box.com/ai/ai-studio, /agents (index copies); readread 2026-09-17

Admins set guardrails on each action, and agents cannot override approval workflows. AI Studio governance includes "applying policy-based guardrails on actions, validating inputs for prompt injection... and keeping humans accountable for consequential decisions", and admins can "restrict actions such as read, write, move, delete, share, and email through guardrails" and switch capabilities such as search and content creation on or off.

The configuration docs state that custom instructions "cannot override human approval workflows, break safety policies enforced in code, access restricted data or classifications, or force tool execution when permissions block them", and instructions can tell the agent to prioritize verification before responding or to ask when unsure.

The docs refer to the approval workflow without describing where an approval step is configured or how it is routed.

Sourcebox.com/ai/ai-studio (index copy); docs.box.com/en/box-ai/creating-and-configuring-agents; readread 2026-09-17

Deep attestations sit alongside permission aware agents. Box's FedRAMP page states "Box holds a FedRAMP Class D certification, previously described as FedRAMP High authorized". The information governance page says Box "meets FedRAMP, FIPS 140-2, ISO 27001, and PCI DSS Level 1 standards" and "maintains certified compliance with HIPAA/HITECH and ISO 27018", and reports SOC 1/2/3. The Trust Center describes an information security management system based on ISO 27001 and NIST 800-53, with SOC reports available under NDA.

Agents answer only from content the user may see and respect existing permissions, classification and retention by default. AI Studio admins restrict agent actions, including read, write, move, delete, share and email, scope knowledge to named files or Hubs, control where an agent appears, and manage which users may use it. Box states customer data is not used to train third party models.

Sourcebox.com/trust, /fedramp, /security/information-governance (index copies); docs.box.com/en/box-ai/creating-and-configuring-agents; readread 2026-09-17

Admins see AI usage by agent and by user, but not a step by step record of each agent run. Admin AI Insights adds "an AI usage dashboard" in the Admin Console with AI queries over time, AI usage by product, and top agents by usage, both chargeable and non chargeable.

Admins can "download detailed user activity reports to break down unit spend by individual user or specific agent", and the Admin Console carries "extensive audit trails for more than 300 actions", with AI usage on the dashboard. AI Studio governance lists maintaining audit trails and logs. The AI Unit insight card runs about two hours behind.

No per run trace of an agent's steps, tool calls or retrieved content is documented. Citations show the sources behind an answer, which is grounding rather than a run record.

Sourceblog.box.com/introducing-admin-ai-insights, box.com/security/it-admin-controls (index copies); docs.box.com/en/box-ai/understanding-ai-units-in-box; readread 2026-09-17

Whether Box agents keep memory is not settled. The agent configuration documentation sets out every element (details, custom instructions, knowledge, suggested prompts, availability, advanced model settings, Pro Mode and Expanded Mode), and none is a memory, session state or learned context surface. The AI Studio and Box Agent pages describe grounding and modes, not memory, and grounding in enterprise content on each run is knowledge rather than memory.

Box's AI documentation runs to several hundred pages, so a memory feature could sit somewhere not covered here. Nothing published describes Box Agent session history or a memory store with a stated scope and lifetime.

Sourcedocs.box.com/llms.txt, /en/box-ai/creating-and-configuring-agents; tried; docs.box.com/_llms/en/ai.mdread 2026-09-17

Customers choose the region where their content is stored. A box.com announcement reads: "Box Zones expands to 10 regions. Switzerland, Singapore, and Israel now available." Box is managed cloud with that regional choice.

There is no on premises or customer cloud deployment, and only three of the ten regions are named in the material available.

Sourcebox.com/security/it-admin-controls and Box Zones announcement (index copies); readread 2026-09-17

Admins get a builder rather than prebuilt agents. AI Studio starts from New Agent, where the admin supplies a name, custom instructions, knowledge bindings, up to four suggested prompts, availability and model settings. The AI Studio page lists use cases a customer could build, such as extracting NDAs and liabilities from data room documents or pulling KYC details from onboarding forms, but these are examples, not adoptable assets. Neither the AI Studio page nor the agent docs offer a prebuilt agent set, template gallery or catalog.

Sourcedocs.box.com/en/box-ai/creating-and-configuring-agents; box.com/ai/ai-studio (index copy); readread 2026-09-17

Every documented way into a Box agent is a person asking. Agents appear where admins publish them, in AI Home, Files and Hubs, and answer when a user asks, with suggested prompts to start an interaction. Box Automate and Relay trigger content workflows on content events, but nothing documents a Box Automate workflow invoking an agent step. No schedule, event or telemetry trigger that starts an agent is published.

Sourcedocs.box.com/en/box-ai/creating-and-configuring-agents; box.com/agents (index copy); readread 2026-09-17

Admins choose the model for each agent. An agent's Advanced settings "choose what model the agent uses when answering questions: you can select Auto or from the list of other providers available in your organization". Pro Mode is on by default, so the agent "uses higher thinking levels and may access more capable and newer models", and the AI units guidance tells admins to use Standard models or Auto for routine work and keep Premium models for complex reasoning. The AI Studio page offers to "select from the most powerful AI models from leading providers like Anthropic, Google, and OpenAI".

Bringing your own model or customer hosted inference is not offered; choice is from Box's provider list.

Sourcedocs.box.com/en/box-ai/creating-and-configuring-agents, /en/box-ai/understanding-ai-units-in-box; box.com/ai/ai-studio (index copy); readread 2026-09-17

Outside agents can reach Box content, and Box publishes developer APIs. Box offers "Box-native agents in Box Agent and Box AI Studio, and third-party platforms accessing Box content through MCP server, including Claude, Microsoft Copilot, GitHub Copilot, Glean, and custom LLMs", so Box serves MCP to outside agents. It also publishes a developer platform (developer.box.com) with APIs and an AI Studio API, and agents generate files in Box Notes, Word, PDF, Excel and PowerPoint for use elsewhere.

Box agents consuming external MCP tools is not documented, though this comes from the product pages rather than the developer reference.

Sourcebox.com/ai/ai-studio, /agents (index copies); readread 2026-09-17

Agents are tested before release, and evaluation tests gate where they can be published. AI Studio includes a Playground where admins "validate behavior, refine instructions, and confirm grounding before broader deployment", using custom suggested prompts against real Box content and swapping models in the same session. The configuration docs add: "Availability expands as your agent passes evaluation tests for increasingly complex knowledge configurations, from single files to multiple files, and Hubs." Passing those tests is the release path.

Box does not describe the evaluation tests in detail, and no scored regression suite is published.

Sourcedocs.box.com/en/box-ai/creating-and-configuring-agents; box.com/ai/ai-studio (index copy); readread 2026-09-17

Content, not screens, is where these agents work. They search permitted files, analyze document sets and generate files inside Box, and external systems reach Box through its MCP server rather than Box operating their interfaces. No browser, desktop or screen control capability is documented; the agent's tools are content operations. With no bot or screen automation estate, breakage when an interface changes is not a concern.

Sourcebox.com/agents, /ai/ai-studio (index copies); docs.box.com/en/box-ai/creating-and-configuring-agents; readread 2026-09-17