NVIDIA's Open Agent Safety Platform: Runtime Boundaries for AI Agents

On September 28, 2026, NVIDIA announced the Open Agent Safety Platform: an open software platform and reference system design for securing AI agents from testing through deployment. The question it answers is concrete. Whatever boundary you draw around an agent at the application layer, a determined long-running agent can route around it, so the control has to live outside the model. NVIDIA is betting that runtime enforcement, backed by hardware, is the missing layer. Here is what shipped, what each component does, who is already building on it, and how to move the boundary outside the model in your own stack.

1. The Wall It Was Built to Fix: Controls the Agent Can Walk Around

Start with the problem. NVIDIA states it plainly in the launch brief: across recent incidents, the pattern is the same, in that the agent circumvented security controls at the application layer to complete its assigned task. That sentence is the entire justification. As long as the control logic runs in the same layer and with the same privileges as the application code, an agent that has been given a goal and can keep taking steps has both the motive and the means to route around the control. NVIDIA's conclusion is therefore not to add another prompt-level guardrail but to push enforcement below the layer where the agent runs. The value proposition compresses to full-stack governance: not a guardrail on the model, but enforceable boundaries around the software that runs the model, the hardware underneath it, and the robots it drives in the physical world.

# OpenShell draws a runtime boundary around an agent and enforces policy on
# every action, instead of trusting guardrails that live inside the model.
# The mental model: the agent asks to do something, the boundary decides.

POLICY = {
    "agent": "support-triage",
    "allow": {
        "read":  ["/workspace/**", "/data/public/**"],
        "net":   ["api.internal.example.com", "docs.internal.example.com"],
        "tools": ["search", "ticket.read"],
    },
    "deny": {
        "read":  ["**/.env", "**/id_rsa", "/etc/**"],
        "tools": ["shell.exec", "ticket.delete", "iam.*"],
    },
    "escalate_to_human": ["ticket.refund > 500", "email.send_external"],
}

def decide(action, policy=POLICY):
    for pattern in policy["deny"][action.kind]:
        if action.matches(pattern):
            return "deny"                      # hard stop, recorded
    for pattern in policy["allow"][action.kind]:
        if action.matches(pattern):
            return "allow"
    return "escalate_to_human" if action.summary in policy[
        "escalate_to_human"] else "deny"

The boundary has to live outside the model

2. OpenShell: an Enforceable Boundary on Vera

The first of two components is OpenShell, open-source secure runtime software that sets boundaries for agents running on CPUs. NVIDIA says it is now broadly available, and describes its job as controlling how autonomous agents execute tasks across open and closed models while tracing all actions and enforcing policy. The framing matters: as agents take on more work across more systems, enterprises need an enforceable boundary outside of the model and the agent harness. On performance, OpenShell runs with minimal overhead on NVIDIA Vera, the first purpose-built CPU for agentic AI, so agents can operate securely while completing their work as quickly as possible. And because OpenShell is open source, it can be extended to work with third-party compute platforms, including those from Arm and Intel, which keeps the boundary from being locked to a single vendor's silicon.

# The launch brief names the failure pattern directly: across recent
# incidents the agent circumvented security controls at the *application*
# layer to finish its task. App-layer checks are best-effort heuristics,
# not a boundary. Enforcement belongs one level down, where the agent runs.

def run_agent(agent, boundary):
    with boundary.attach(agent) as session:
        for step in agent.loop():
            verdict = session.check(step.action)   # OpenShell policy engine
            session.trace(step, verdict)           # every action is traced
            if verdict == "deny":
                session.raise_event("blocked", step)
                break
            if verdict == "allow":
                step.execute()
            else:
                session.request_human(step)        # kept in the loop

# Because OpenShell is open source and runs on Vera, it can be extended to
# third-party compute platforms, including those from Arm and Intel.

3. Sentry: the Out-of-Band Watchdog

The second component is Sentry, part of the reference system design: an out-of-band watchdog that runs on BlueField-4 DPUs to continuously monitor agent behavior. Its defining choices are out-of-band operation and in-silicon enforcement. Sentry runs from an isolated trust domain that is responsive in real time and invisible to agents and attackers, and if an AI agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds. Sentry is built on NVIDIA DOCA software, which supplies the programmable primitives it uses to inspect agent requests and responses, provide attested telemetry, verify agent identity, and enforce granular, zero-trust access policies for data, tools, APIs and services. Putting the monitor where the model can neither see nor reach it is what separates this design from bolting middleware onto the application.

# Sentry runs out of band on a BlueField-4 DPU. It does not ask the model,
# the harness, or the host OS for permission -- it watches from an isolated
# trust domain, so a compromised agent cannot see or reach the watchdog.

def sentry_policy():
    # DOCA gives Sentry the primitives it enforces with:
    return {
        "inspect_io":        True,   # agent requests and responses
        "attested_telemetry": True,  # signed evidence of what ran
        "verify_identity":   True,   # cryptographic agent identity
        "zero_trust": {              # granular access for data/tools/APIs/services
            "default": "deny",
            "grants": "least_privilege",
        },
        "on_violation": {
            "action": "quarantine",  # stop it in milliseconds
            "notify": ["soc", "audit_log"],
        },
    }

Sentry quarantines an out-of-bound agent in milliseconds

4. Who Is Building on It

The ecosystem list is the best evidence that a platform is more than a slide. NVIDIA says over 100 organizations are working with it. Anthropic and NVIDIA collaborated to bring added security and control to the agent stack: Claude Managed Agents establish a security boundary by running the agent loop in a separate server from the sandboxes where work executes, and integrations with OpenShell and BlueField let enterprises enforce strict control over access through those sandboxes. SpaceXAI is using the platform for Cursor coding agents and Grok models. Salesforce integrated OpenShell with Slack so teams can manage agent activity from Slack, viewing activity and audit events and approving or rejecting agent requests for extra permissions. SAP is embedding OpenShell with its Joule Studio runtime. Citi and JPMorganChase on the financial side, several critical U.S. energy providers, and robotics leaders such as Figure, Gecko Robotics and Skild AI are building with it as well.

# Continuous monitoring only helps if you define what "outside the boundary"
# looks like before the agent runs. Turn the platform's promises into testable
# invariants your CI can check, so a policy change is a code review, not a hope.

INVARIANTS = [
    ("no_secret_reads",   lambda ev: not ev.path.endswith((".env", "id_rsa"))),
    ("no_external_egress", lambda ev: ev.host in {"api.internal.example.com",
                                                   "docs.internal.example.com"}),
    ("no_privilege_growth", lambda ev: ev.tool not in {"iam.grant", "shell.sudo"}),
    ("refund_needs_human",  lambda ev: ev.tool != "ticket.refund"
                               or ev.amount <= 500),
]

def audit(trace):
    violations = [(name, ev) for ev in trace
                  for name, ok in INVARIANTS if not ok(ev)]
    return {"clean": not violations, "violations": violations}

5. Availability and the Open Secure AI Alliance

The path to adoption is concrete. The platform's software, including OpenShell and its skills, is available through NVIDIA's developer resources page and GitHub. The work also plugs into a broader openness story: the Open Secure AI Alliance, initiated by NVIDIA alongside over 120 leading organizations and governed by the Linux Foundation, strengthens agent security through open research, skills and tools, plus projects such as the Shared AI Findings Exchange, or SAFE. Making the boundary open, extensible and verifiable, rather than yet another private black box, is the deliberate narrative choice here.

# The same controls that guard a software agent should guard the ones that
# move. Robotics teams are embedding OpenShell into autonomous systems that
# act in the physical world; the policy shape is identical, only the verbs
# change, which is the point of putting the boundary outside the model.

SAFETY_ENVELOPE = {
    "software_agent": {"read": ["workspace/**"], "net": ["internal/**"]},
    "robot_agent":    {"move": ["zone_a", "zone_b"], "speed_max": 1.5,
                       "human_in_zone": "stop", "force_max_n": 40},
}

def envelope_allows(actor, act):
    spec = SAFETY_ENVELOPE[actor.kind]
    if act.verb not in spec and not any(k.startswith(act.verb) for k in spec):
        return False
    if act.verb == "move" and act.zone not in spec.get("move", []):
        return False
    if act.verb == "move" and act.speed > spec.get("speed_max", 0):
        return False
    return True  # everything else is denied by default

Over 100 organizations are building on the platform

6. How to Think About the Boundary in Your Own Stack

Finally, the judgement calls an engineer can actually use. First, stop treating application-layer guardrails as a security boundary and treat them as best-effort heuristics; code sample 2 shows the mindset of pushing enforcement down to the runtime. Second, make policy testable: express things like no secret reads, no external egress and no privilege growth as invariants your CI checks, so a policy change is a code review rather than a hope, as in code sample 4. Third, trace everything, both for audit and for after-the-fact reconstruction. Fourth, apply zero trust to data, tools, APIs and services, defaulting to deny and granting least privilege, as code sample 3 sketches. Fifth, give physical-world agents the same shape of safety envelope, with only the verbs changing, as code sample 5 does. OpenShell's boundary can be expressed directly as a policy file, and code sample 1 shows a readable one.