Introducing NVIDIA OpenShell Reference Architecture for Safer AI Agents

Enterprises are preparing to deploy billions of AI agents. To be useful, they'll reason, plan, use tools, access data, and work together. Today, the only thing stopping an agent from misusing all that is asking it nicely. Please don't delete anything. Please don't delete anything. Please don't touch my SSH keys. That's the please don't approach. But hope isn't security. Safety isn't an aspiration. It's technology and engineering. NVIDIA OpenShell and Sentry put that philosophy into practice. You write a policy for what each agent can touch, and OpenShell enforces it at the granularity of system calls, file access, and network connections. Formal verification checks every policy change against your permission ceiling, so agents never gain more access than intended. It's like the early Internet. Viruses were everywhere until browsers enforced strict limits on what a web page could do. OpenShell does the same for agents. Enforcement happens outside the agent, not just in LLM guardrails, bringing agent-native security into your infrastructure. Every agent runs inside its own isolated sandbox, with no direct route to the network. Every outbound network request goes through the supervisor, outside the sandbox. It checks the action against your policy. If it's not permitted, it's denied. Keys stay outside with the supervisor and are added only on the way to an approved endpoint. A compromised agent can't leak a key it never had. The gateway is the control plane. The supervisor makes the decisions. The sandbox holds the agent. And the policy prover checks proposed policies against your permission ceilings. Open Shell combines Linux kernel isolation with runtime policy enforcement. NVIDIA Sentry adds an optional layer of protection outside the host itself, away from the agent. Running on NVIDIA BlueField-4, Sentry monitors agent activity and enforces security policies in a hardware-isolated trust domain. Because agent reasoning traffic passes through Sentry, if the agent is planning to do something unintended, it will update policies immediately and cut the connection to the model, quarantining it in milliseconds. And it keeps tamper-evident records that operators can verify for detection, investigation, and response. OpenShell is open-source under Apache 2.0, runs everywhere your agents do, edge to cloud, and takes two commands to adopt. Install the CLI, create a sandbox, and run your favorite agent. Agents are only as useful as the access you give them. OpenShell and Sentry put that access under your control. That's how we advance AI capabilities and safety together. Thank you.