{"resourceId":"nvidia-devblog-openshell-010-20260928","versions":[{"version":"external-fb0651571f53de24da3a6f4c4c4fe35552103d5fdb4bae8cc816c45fd9ae4c29","resource":{"id":"nvidia-devblog-openshell-010-20260928","title":"OpenShell 0.1.0: open-source runtime controls for AI agents without rewriting them","organization":"NVIDIA","sector":"AI agent runtime / developer platforms","geography":"Global (vendor technical blog; open source)","publishedAt":"2026-09-28T00:00:00Z","publicationDate":"2026-09-28","eventDate":"2026-09-28","sourceName":"NVIDIA Developer Blog","sourceLabel":"Vendor technical how-to","sourceUrl":"https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","data-security","operating-model"],"finding":"Sep 28, 2026 NVIDIA Developer Blog presents OpenShell 0.1.0 as an open-source runtime that enforces which systems and data an agent can access without rewriting the agent. Components include Gateway (fleet lifecycle/policies), Sandbox (kernel-level filesystem/process controls), and Supervisor (inspects outbound requests against policy). It highlights credential substitution outside the agent workload, a formal policy prover, Docker/Kubernetes compute drivers, and support for frameworks such as Codex, Claude Code, Pi, and Hermes; OpenShell is described as the runtime layer of the broader Open Agent Safety Platform.","sledRelevance":"Actionable starting point for campus/agency developer platforms that want policy around existing coding agents before granting production credentials.","evidence":"Opened Sep 28, 2026 blog by Watson/Golshan; states OpenShell 0.1.0 capabilities, component roles, policy prover, framework support, and platform layering.","architectureImplications":"Insert OpenShell between agents and tools/APIs; keep secrets in supervisor/middleware, not in agent context.","governanceImplications":"Policy prover and non-self-approval of policy changes create review gates that delivery teams must staff.","securityPrivacyImplications":"Credential placeholder pattern reduces secret exposure inside agent workloads if correctly implemented.","caveats":"0.1.0 early release; adoption examples (Cadence, Slack, Gecko) are vendor-cited; no SLED measured failure/success rates.","streamIds":["nvidia"],"roles":{"sales":"Open with a practical runtime control story: OpenShell 0.1.0 (Sep 28) claims you can wrap existing agents—Codex, Claude Code, Pi, Hermes—with kernel-level sandboxing, outbound policy checks, and credentials held outside the workload. Sell a bounded developer-platform pilot, not a finished compliance product. Discovery: which agent frameworks, where secrets live today, and who reviews policy changes. Unsupported: rewriting-free perfection or production-hardening guarantees at 0.1.0.","engineering":"Fit for teams that can run Docker/Kubernetes sandboxes and define API allowlists. Integrate Gateway/Sandbox/Supervisor in front of tool access; wire IdP/trusted middleware for credential substitution. Prerequisites: policy definitions, sandbox nodes, CI for policy packages. Constraints: early version; prover covers modeled permissions, not all real-world side channels. Proof: agent cannot write to protected repo/API; secrets never appear in agent logs.","delivery":"Work: deploy OpenShell quickstart, encode one agent class policy, connect audit logs, train reviewers on policy-change workflow. Dependencies: K8s/Docker, secret store, GitHub/dev docs. Ownership: developer platform + AppSec. Skills: policy-as-code and sandbox ops. Governance: no agent self-approval of privilege expansion. Acceptance: deny/allow test suite green. Risks: 0.1.0 instability or incomplete protocol inspection."},"roleDetails":{"sales":{"customerProblem":"Developer platforms need runtime controls for agents without rewriting every harness.","stakeholders":["developer platform","AppSec","research computing"],"discoveryQuestions":["Which agent frameworks?","Where do API keys live today?","Who approves privilege changes?"],"valueHypothesis":"OpenShell 0.1.0 may let teams sandbox existing agents and keep secrets outside the workload.","potentialEngagement":"Two-week OpenShell wrap of one coding-agent workflow with deny tests.","unsupportedClaims":["Production-ready at 0.1.0","Complete side-channel immunity"]},"engineering":{"fit":"Fit for Docker/K8s agent platforms needing outbound policy and credential mediation.","architectureIntegration":"Gateway + Sandbox + Supervisor in front of tools; secrets substituted outside agent.","prerequisites":["OpenShell 0.1.0","sandbox capacity","policy store","secret manager"],"constraints":["Early release","inspection coverage depends on configuration"],"security":"Keep real credentials out of agent-visible environment; log policy decisions.","proofOfValue":["Protected write denied","Secret not in agent logs","Policy change requires human approve"]},"delivery":{"work":"Stand up OpenShell, migrate one agent class, operationalize policy reviews.","dependencies":["K8s/Docker","IdP","SIEM","agent inventory"],"ownership":"Developer platform engineering with AppSec co-ownership.","skillsAdoption":"Train on policy packages and quarantine/deny response.","governanceCheckpoints":["Policy review board","Secret-handling checklist","Version pin for 0.1.x"],"acceptanceCriteria":["Test suite recorded","On-call runbook published"],"risks":["Version churn","Over-permissive initial policies"]}},"retrievedAt":"2026-09-29T03:03:53Z","enrichedAt":"2026-09-29T03:08:25Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Quickstart and policy examples should be usable by app developers who are not kernel specialists.","procurementImplications":"Open-source runtime may still imply support, training, and DPU follow-on spend.","operatingModelImplications":"Create a durable policy-review function before scaling agent counts.","sourceVerification":{"openedUrl":"https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell/","referenceExcerpt":"NVIDIA OpenShell 0.1.0 is an open-source runtime for defining and enforcing","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}