From the NVIDIA edition of October 21, 2026
NVIDIA launches OpenShell Reference Architecture: agent sandboxing on Vera CPUs with BlueField-4 'in-silicon' enforcement via NVIDIA Sentry; security vendors, SAP and ServiceNow integrate
NVIDIA; partners including CrowdStrike, Palo Alto Networks, Cisco, Microsoft, SAP, ServiceNow, Palantir, BBVA, Santander · AI agent security and governance (enterprise and edge) · Global (announced at GTC Berlin)
- Publisher
- NVIDIA Newsroom
- Original publication
- 2026-10-21
- Source retrieved
- 2026-10-22
- Event date
- 2026-10-21
What happened
NVIDIA announced the OpenShell Reference Architecture, available now, for building, containing, observing and enforcing agents. It combines Vera Rubin infrastructure for model inference, Vera CPUs running the open-source OpenShell runtime for agent harnesses and tool use, and BlueField-4 DPUs running NVIDIA Sentry for continuous out-of-band monitoring; NVIDIA says if an agent moves outside its software boundary Sentry quarantines and stops it in milliseconds, and that the offload boosts agent capacity by up to 20%. It extends to RTX Spark, DGX Spark and DGX Station at the edge and runs on Canonical, SUSE and Red Hat Linux, Kubernetes, Windows via Microsoft Execution Containers, and AWS, Google Cloud and Azure. Security vendors (1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI, Zscaler) are integrating support; BBVA and Santander are exploring it; ServiceNow says its AI Passport layer lets enterprises revoke an agent's access across software and hardware within seconds.
Why it matters
Relevant to SLED CIOs and CISOs drafting agent policies: it is a concrete architecture for containing agents that act with staff credentials, and several partners (ServiceNow, Microsoft, SAP, CrowdStrike, Palo Alto) are common in state, local and campus estates. No public-sector deployment is named, and the hardware enforcement layer requires BlueField DPUs that most public data centres lack.
Evidence and measured results
Vendor release with partner list and performance claims ('milliseconds', 'up to 20%', '30x higher throughput per megawatt') without methods. Partners are mostly integrating or exploring, not reporting production results.
Limitations and uncertainty
No independent test of Sentry or the full architecture; partner commitments are integrations or explorations; hardware enforcement limited to BlueField-equipped systems.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-22; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agents acting with staff credentials can leak data or take unauthorised actions; prompt-level guardrails are not enforceable controls.
- Stakeholders
- CISO
- CIO or enterprise architect
- Privacy officer
- Application owners piloting agents
- Discovery questions
- Which agents are running or planned, and with what credentials?
- Do existing hosts include BlueField DPUs?
- How are agent access changes approved and logged today?
- Value hypothesis
- Interpretation: environment-level containment could make agent pilots approvable by security teams; no measured public-sector results exist.
- Potential engagement
- Agent containment design and policy review pilot on a non-production workload.
- Unsupported claims
- Millisecond quarantine as a verified figure
- Protection for agents on non-BlueField hardware at the silicon layer
- Production readiness for regulated public data
Pre-sales engineering
Role takeaway
- Fit
- Organisations moving agents beyond chat into tool use with real credentials.
- Architecture and integration
- OpenShell sandbox per agent; optional BlueField-4 with Sentry; logs to SIEM; identity from enterprise IdP through partner integrations.
- Prerequisites
- Inventory of agents and tools
- Identity provider integration
- Log pipeline to security operations
- Constraints
- In-silicon enforcement only where BlueField is installed
- Partner integrations still maturing
- Kubernetes and Windows paths differ from tested configurations
- Security
- Enforce deny-by-default egress, manual approval of access changes, and credential injection outside the sandbox.
- Proof of value
- Red-team a pilot agent with prompt-injection and malicious-script tests
- Measure revocation time end to end
- Confirm audit logs capture every denied and approved action
Delivery
Role takeaway
- Work
- Stand up policy management, approval workflows, logging and revocation for a pilot set of agents.
- Dependencies
- Security operations integration
- Identity provider
- Platform team for sandbox hosting
- Ownership
- CISO office for policy; platform team for runtime operation.
- Skills and adoption
- Security and platform staff need training in agent policy authoring and review.
- Governance checkpoints
- Policy review before each agent goes live
- Change approval for new network access
- Quarterly audit of agent permissions
- Acceptance criteria
- Proposed: zero unapproved egress destinations in pilot audit
- Proposed: revocation completed within an agreed time in a drill
- Proposed: all policy changes traceable to an approver
- Risks
- Permissive or auto-approved policies undermining containment
- Logging gaps hiding blocked attempts
- Vendor lock-in through hardware-specific enforcement
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Layers: inference on GPUs, agent harness in an OpenShell sandbox on CPUs, enforcement on DPUs; software-only OpenShell can run without the hardware layer, but in-silicon enforcement needs BlueField.
Governance
Who approves, reviews and stays accountable for outcomes?
Moves agent controls into the environment (policy files, out-of-band monitoring, revocation) where they can be audited, rather than relying on prompts.
Security and privacy
What data, permissions and controls need testing?
Promises containment and rapid revocation; effectiveness depends on policy configuration and is not independently evaluated for the full reference architecture.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Requires security teams able to write and review agent policies.
Procurement
What should contracts, pricing and exit terms secure?
Hardware-level enforcement ties agent governance to specific NVIDIA DPUs; buyers with mixed estates need to know which controls work without them.
Operating model
Which teams own the service once it runs?
Agent policy becomes an operational artefact managed like firewall rules, with approval and revocation workflows.
Publication history
- 2026-10-21NVIDIA · Issue 469 resources
Stable resource ID: nvidia-newsroom-openshell-reference-architecture-safe-agents-20261021