NVIDIA releases OpenShell architecture to enforce AI-agent rules in software and hardware

NVIDIA released its OpenShell Reference Architecture at GTC Berlin on October 21, 2026, putting agent execution and security enforcement into a coordinated infrastructure design. The architecture, available now, combines an open-source software boundary with a separate hardware monitoring layer. Its central distinction is where authority sits: outside the agent doing the work.

Permission checks versus an independent watchdog

The announcement extends NVIDIA’s OpenShell secure runtime into a full infrastructure stack. Vera Rubin runs models, while Vera CPUs run the software that coordinates agents and their tool use. BlueField-4 data processing units provide a separate place for NVIDIA Sentry security software to monitor activity and enforce rules.

The software starts from a restrictive premise: agent workloads remain untrusted throughout execution and receive access only as needed. NVIDIA’s technical blog describes controls covering files, internet services and systems that interact with physical devices. Rather than asking an agent to obey instructions, OpenShell checks what it can actually reach.

Four components divide those responsibilities. A sandbox is the isolated environment where an agent runs; the other components manage that environment, check requests and examine the permissions themselves.

• Gateway manages sandbox lifecycles and policies.
• Supervisor checks outbound requests against policy and mediates credential access. It runs separately from the sandbox.
• Sandbox isolates the workload and restricts access to files and processes.
• Policy Prover uses formal verification to check whether permissions stay within an organization-defined ceiling.

Operators can also add checks without rebuilding the core runtime. Supervisor extensions can inspect, block or change network content. Gateway extensions let organizations add deployment-specific governance. OpenShell supplies enforcement points for identity, authorization, data protection and auditing systems, rather than treating those functions as interchangeable.

The hardware layer watches from outside

BlueField-4 adds a hardware-isolated security domain beyond the software boundary. In this design, it sits between agents running on Vera and the models they access. Sentry runs there, independently of the agent, to observe requests and responses, network and file activity, identity and delegated authority.

Sentry also analyzes selected host memory for deviations from authorized behavior, without relying on an agent’s own account of its actions. NVIDIA says a detected threat or policy violation can trigger quarantine within milliseconds. The technical blog explicitly describes this as an optional hardware safeguard alongside OpenShell’s software controls.

Execution speed and deployment reach

The performance case addresses a different problem: agents repeatedly alternate between model reasoning, tool calls, code execution and data queries. Those dependent steps must finish in sequence. NVIDIA positions Vera as the CPU layer for shortening those steps while supporting many concurrent workflows.

According to NVIDIA’s blog, CoreWeave measured sandbox startup more than three times faster on Vera than on a leading x86 CPU. It also measured 1.8 times faster agent-loop completion across 20 real-world tasks using Terminal Bench, including scripting and database recovery. A single rack supported more than 11,000 concurrent agent environments. These are execution-performance measurements, not tests of the security controls.

NVIDIA says the architecture supports Linux and Kubernetes infrastructure from Canonical, SUSE and Red Hat, plus Windows through Microsoft Execution Containers. It also supports cloud operating systems from AWS, Google Cloud and Microsoft Azure. The design extends to edge deployments using RTX Spark, DGX Spark and DGX Station systems.