Loading page…
OpenShell is available now; Sentry is a reference design meant to monitor agents independently and stop them when they cross software boundaries.
Listen to this story
NVIDIA’s platform combines OpenShell, now broadly available, with Sentry, a hardware watchdog reference design that has no general-availability date. OpenShell traces agent actions and enforces runtime policies; Sentry is designed to monitor those boundaries independently on BlueField-4 DPUs and stop or quarantine agents in milliseconds. The split gives enterprises a software control they can deploy today and a separate hardware enforcement approach to evaluate.
OpenShell is open source, works with NVIDIA Vera CPUs, and can be extended to Arm and Intel platforms.
Sentry uses DOCA to inspect requests and responses, verify identity, and enforce access rules for data, tools, and services.
Anthropic integrated the approach with Claude Managed Agents; a separate server runs the agent loop from its work sandboxes.
An AI agent that works around a software rule is the failure NVIDIA wants to catch from outside the agent itself. On September 28, the company introduced Open Agent Safety Platform, pairing an available secure runtime with a hardware watchdog design intended to stop agents that cross their boundaries.
NVIDIA points to recent incidents in which agents circumvented application-level controls while completing assigned tasks. Its response is to put enforceable limits around the environment where an agent runs, then monitor that boundary from a separate system. Organizations can deploy the platform’s elements according to their needs.
The software layer is OpenShell, an open-source runtime that traces agent actions and enforces policies as agents run. First announced in March, it is now broadly available through NVIDIA developer resources and GitHub. NVIDIA describes its Vera CPUs as one place to run it; the software can also be extended to platforms from Arm and Intel.
Sentry is the second layer: a reference design for a watchdog running on NVIDIA BlueField-4 data processing units. It is designed to monitor agent activity from an isolated hardware domain, rather than rely on the agent to report its own behavior. NVIDIA says Sentry can quarantine and stop an agent in milliseconds if it tries to move beyond its software boundary.
Under the design, Sentry uses NVIDIA’s DOCA software to inspect agent requests and responses, verify identity and apply access rules for data, tools and services. Those controls would operate independently of the runtime boundary OpenShell enforces.
NVIDIA says it worked with Anthropic on integrations for Claude Managed Agents. Anthropic runs the agent loop on a separate server from the sandboxes where agent work executes. OpenShell and BlueField are intended to give enterprises additional control over access through those sandboxes, rather than replace that separation.
NVIDIA and Salesforce have also integrated OpenShell with Slack. Teams can view agent activity and audit events there, then approve or reject requests for more permissions. SAP is embedding OpenShell in its Joule Studio runtime.
NVIDIA says more than 100 organizations are working with the platform’s technologies, across software, infrastructure, robotics and other fields. That figure covers varied forms of work, not necessarily deployments of both OpenShell and Sentry.
NVIDIA has not given a general-availability date for Sentry. Its milliseconds claim comes without independent test results in the announcement. The next question is whether the hardware design can deliver that response when deployed with agents.
Story updates
In a Vera Rubin POD, NVIDIA says a BlueField-4 chip sits on an AI agent’s only route to its model. That gives the chip a proposed way to interrupt the agent’s next step without relying on the agent to stop itself. NVIDIA described the arrangement in its September 28 introduction of the Open Agent Safety Platform. The platform works with other hardware, but NVIDIA specifies this model-path position for Vera Rubin PODs.
An agent needs another response from its model to decide what to do next. NVIDIA’s design treats that connection as both a place to observe activity and a point where an operator can interrupt it. In a Vera Rubin POD, BlueField-4 is isolated from the host system and, NVIDIA says, can enforce policies in real time from a position the agent cannot reach.
NVIDIA calls departures from an assigned task or operating limits “drift.” A blocked action, bug, missing tool or unclear instruction can contribute to it, the company says. Putting enforcement outside the agent is meant to keep those controls in place even when its behavior veers off course.
The platform starts with OpenShell, an Apache 2.0 open-source runtime that runs agents in isolated sandboxes. Operators set rules for the files, networks, tools, processes and credentials an agent can access. OpenShell checks the rules before work starts and enforces them while the agent runs. Organizations can use this software layer without adding the optional hardware layer, Sentry.
Sentry moves additional monitoring and enforcement onto BlueField hardware. NVIDIA says its DOCA software connects that layer to OpenShell’s rules and links agent interactions with policy decisions and access to tools and data. That activity record is intended to help safety systems spot drift and investigate suspicious behavior. It is a separate view of the agent’s actions, rather than the agent’s own account of them.
These layers answer different questions. OpenShell restricts what an agent may access. Sentry adds observation and enforcement from separate hardware. The proposed ability to interrupt an agent through its model connection depends on the chip occupying that connection. A deployment decision therefore turns on more than whether the platform’s software is compatible: it also turns on how the hardware is arranged.
nvidia.comLoading discussion...
Join the conversation
What would make you confident in the safeguard?
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.