{"resourceId":"nvidia-newsroom-openshell-reference-architecture-safe-agents-20261021","versions":[{"version":"external-610d1e0cdc4df420a7a6bd5894dd4d31926222252cf11e93fbcb1218f19c96ff","resource":{"id":"nvidia-newsroom-openshell-reference-architecture-safe-agents-20261021","title":"NVIDIA launches OpenShell Reference Architecture: agent sandboxing on Vera CPUs with BlueField-4 'in-silicon' enforcement via NVIDIA Sentry; security vendors, SAP and ServiceNow integrate","organization":"NVIDIA; partners including CrowdStrike, Palo Alto Networks, Cisco, Microsoft, SAP, ServiceNow, Palantir, BBVA, Santander","sector":"AI agent security and governance (enterprise and edge)","geography":"Global (announced at GTC Berlin)","publishedAt":"2026-10-21","publicationDate":"2026-10-21","eventDate":"2026-10-21","sourceName":"NVIDIA Newsroom","sourceLabel":"Vendor press release","sourceUrl":"https://nvidianews.nvidia.com/news/openshell-reference-architecture","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","data-security","infrastructure","governance-procurement"],"finding":"NVIDIA announced the OpenShell Reference Architecture, available now, for building, containing, observing and enforcing agents. It combines Vera Rubin infrastructure for model inference, Vera CPUs running the open-source OpenShell runtime for agent harnesses and tool use, and BlueField-4 DPUs running NVIDIA Sentry for continuous out-of-band monitoring; NVIDIA says if an agent moves outside its software boundary Sentry quarantines and stops it in milliseconds, and that the offload boosts agent capacity by up to 20%. It extends to RTX Spark, DGX Spark and DGX Station at the edge and runs on Canonical, SUSE and Red Hat Linux, Kubernetes, Windows via Microsoft Execution Containers, and AWS, Google Cloud and Azure. Security vendors (1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI, Zscaler) are integrating support; BBVA and Santander are exploring it; ServiceNow says its AI Passport layer lets enterprises revoke an agent's access across software and hardware within seconds.","sledRelevance":"Relevant to SLED CIOs and CISOs drafting agent policies: it is a concrete architecture for containing agents that act with staff credentials, and several partners (ServiceNow, Microsoft, SAP, CrowdStrike, Palo Alto) are common in state, local and campus estates. No public-sector deployment is named, and the hardware enforcement layer requires BlueField DPUs that most public data centres lack.","evidence":"Vendor release with partner list and performance claims ('milliseconds', 'up to 20%', '30x higher throughput per megawatt') without methods. Partners are mostly integrating or exploring, not reporting production results.","architectureImplications":"Layers: inference on GPUs, agent harness in an OpenShell sandbox on CPUs, enforcement on DPUs; software-only OpenShell can run without the hardware layer, but in-silicon enforcement needs BlueField.","governanceImplications":"Moves agent controls into the environment (policy files, out-of-band monitoring, revocation) where they can be audited, rather than relying on prompts.","securityPrivacyImplications":"Promises containment and rapid revocation; effectiveness depends on policy configuration and is not independently evaluated for the full reference architecture.","caveats":"No independent test of Sentry or the full architecture; partner commitments are integrations or explorations; hardware enforcement limited to BlueField-equipped systems.","streamIds":["nvidia"],"roles":{"sales":"Sales framing: agent safety is now pitched as infrastructure, which matches what public-sector CISOs are asking for before allowing agents near citizen or student data. Interpretation: lead with policy and containment design using the open-source runtime, then discuss whether hardware enforcement is warranted. No public-sector production use is reported, and claims such as millisecond quarantine are unverified, so position any work as an evaluation.","engineering":"Engineering framing: OpenShell sandboxes the agent with filesystem, process and network policy; Sentry on BlueField-4 adds out-of-band enforcement. Pre-sales engineers should map which controls run on existing x86 or cloud hosts versus which need DPUs, and how the architecture integrates with the customer's identity provider and SIEM. Independent tests of the underlying runtime show operator settings decide outcomes, so policy review must be part of any design.","delivery":"Delivery framing: agent policy needs owners, change control and audit, like network security rules. Delivery teams should establish a policy repository, approval workflow for access changes, log forwarding to the security operations centre and a tested revocation procedure. Start with low-risk internal agents. Revocation drills should be repeated regularly. Acceptance criteria below are proposals; the release reports partner integrations rather than observed public-sector outcomes."},"roleDetails":{"sales":{"customerProblem":"Agents acting with staff credentials can leak data or take unauthorised actions; prompt-level guardrails are not enforceable controls.","stakeholders":["CISO","CIO or enterprise architect","Privacy officer","Application owners piloting agents"],"discoveryQuestions":["Which agents are running or planned, and with what credentials?","Do existing hosts include BlueField DPUs?","How are agent access changes approved and logged today?"],"valueHypothesis":"Interpretation: environment-level containment could make agent pilots approvable by security teams; no measured public-sector results exist.","potentialEngagement":"Agent containment design and policy review pilot on a non-production workload.","unsupportedClaims":["Millisecond quarantine as a verified figure","Protection for agents on non-BlueField hardware at the silicon layer","Production readiness for regulated public data"]},"engineering":{"fit":"Organisations moving agents beyond chat into tool use with real credentials.","architectureIntegration":"OpenShell sandbox per agent; optional BlueField-4 with Sentry; logs to SIEM; identity from enterprise IdP through partner integrations.","prerequisites":["Inventory of agents and tools","Identity provider integration","Log pipeline to security operations"],"constraints":["In-silicon enforcement only where BlueField is installed","Partner integrations still maturing","Kubernetes and Windows paths differ from tested configurations"],"security":"Enforce deny-by-default egress, manual approval of access changes, and credential injection outside the sandbox.","proofOfValue":["Red-team a pilot agent with prompt-injection and malicious-script tests","Measure revocation time end to end","Confirm audit logs capture every denied and approved action"]},"delivery":{"work":"Stand up policy management, approval workflows, logging and revocation for a pilot set of agents.","dependencies":["Security operations integration","Identity provider","Platform team for sandbox hosting"],"ownership":"CISO office for policy; platform team for runtime operation.","skillsAdoption":"Security and platform staff need training in agent policy authoring and review.","governanceCheckpoints":["Policy review before each agent goes live","Change approval for new network access","Quarterly audit of agent permissions"],"acceptanceCriteria":["Proposed: zero unapproved egress destinations in pilot audit","Proposed: revocation completed within an agreed time in a drill","Proposed: all policy changes traceable to an approver"],"risks":["Permissive or auto-approved policies undermining containment","Logging gaps hiding blocked attempts","Vendor lock-in through hardware-specific enforcement"]}},"retrievedAt":"2026-10-22T03:00:07Z","enrichedAt":"2026-10-22T03:10:04Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires security teams able to write and review agent policies.","procurementImplications":"Hardware-level enforcement ties agent governance to specific NVIDIA DPUs; buyers with mixed estates need to know which controls work without them.","operatingModelImplications":"Agent policy becomes an operational artefact managed like firewall rules, with approval and revocation workflows.","sourceVerification":{"openedUrl":"https://nvidianews.nvidia.com/news/openshell-reference-architecture","referenceExcerpt":"if an agent attempts to move outside its software boundary, NVIDIA Sentry quarantines and stops it in milliseconds.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}