Nvidia wants AI agents to get work done while businesses keep control of their files, tools and credentials. Jensen Huang's company is expanding OpenShell into a design that puts those safeguards across software and hardware.
Announced at GTC Berlin on October 21, the OpenShell Reference Architecture builds on the company's existing open-source runtime. It brings together the computers that run AI models, the processors handling agents' work and separate hardware designed to monitor what those agents do.
Huang explained the reasoning in Nvidia's announcement:
"AI capability and safety must advance together. As enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture."
The problem becomes practical once an agent can read files, install software, use account credentials and contact outside services. Each permission gives it another way to get work done. Those same permissions can expose company information or enable actions the business never intended to authorize.
Giving agents boundaries
OpenShell runs agents inside isolated software environments called sandboxes. Operators set policies defining which files, processes, network destinations and services an agent may access. The runtime enforces those permissions while the agent works.
Nvidia's documentation describes checks on network requests before they leave the sandbox. Provider credentials stay outside the agent's environment and are attached to requests only where policy allows them. That lets an agent use an approved service without being handed the underlying secret.
The software also checks proposed network-policy changes for newly granted access. Its policy prover flags risks such as reaching a new destination with credentials or using a new API method, holding those changes for human review.
Nvidia executive Ian Buck described why the company sees a need for additional controls at a press briefing covered by SDxCentral:
"Long-running agents combine tools, credentials, and network access in ways that traditional security controls were not designed to govern. So, protecting these workloads requires really clear runtime boundaries, visibility into the agent behavior, and independent enforcement across the infrastructure stack that they run on."
Hardware adds another line of control
The new reference architecture assigns different jobs to Nvidia's chips. Vera Rubin infrastructure runs AI models. Vera CPUs handle the software organizing agents' work and tool use. BlueField-4 data processing units run the company's Sentry security framework.
Sentry is designed to operate in a hardware-isolated environment, separate from the host software running the agent. Nvidia says that arrangement lets it retain monitoring and enforcement capabilities if an agent escapes its software sandbox or tampers with host-based records.
In an October 21 technical post, the company describes combining inspection of network requests with information about running processes and their operating environment. It says Sentry can quarantine agents within milliseconds without needing cooperation from the agent or host software.
The design also keeps tamper-evident activity records on BlueField, giving security teams information to reconstruct an incident even if logs inside an agent's environment have been altered.
Nvidia says the reference architecture is available now. The company plans to make Sentry available in early 2027, according to its October 21 technical post. Developers can start experimenting with existing DOCA libraries and microservices ahead of that release.
The design spans cloud infrastructure and smaller systems, including DGX Spark and DGX Station. Nvidia lists Anthropic, OpenAI, Microsoft, Cisco and CrowdStrike among companies working with the architecture or integrating support. It also supports enterprise operating systems and container environments, giving businesses ways to fit it into infrastructure they already use.
The safeguards depend on the permissions a business chooses. Nvidia's security guidance warns that every allowed network destination is a potential route for data to leave the sandbox. It recommends starting with a minimal access policy and adding only the endpoints an agent actually needs for its task.