NVIDIA brings agent isolation and policy enforcement into a full-stack OpenShell design

The GTC Berlin reference architecture separates model inference, agent execution and independent policy enforcement across Rubin, Vera and BlueField.

NVIDIA has introduced an OpenShell reference architecture that combines its secure agent runtime with computing, networking and independent enforcement infrastructure. Announced at GTC Berlin on 21 October, the design assigns model inference to Vera Rubin systems, agent harnesses and tools to Vera CPUs, and monitoring and policy enforcement to BlueField-4 processors running NVIDIA Sentry.

The architecture extends the existing OpenShell runtime into a broader operating design. It addresses the infrastructure needed around an agent that can use tools and act on company systems over an extended period.

Separate places for reasoning, action and enforcement

An agent's model call is only one part of its working session. The harness decides which tools to call, maintains task context and handles results. Those tools can read documents, execute code or invoke business services. NVIDIA's reference architecture makes that execution layer distinct from both model serving and the system enforcing its boundaries.

The company describes Sentry as providing continuous monitoring outside the agent's own execution environment. That placement matters operationally: a process making a request does not also have to be the only authority deciding whether the request is permitted. An operator can express a policy independently of the model's instructions and observe what actually happened.

The published design supports enterprise Linux and Kubernetes environments, Windows through Microsoft Execution Containers, and major cloud operating environments. NVIDIA also describes extensions to RTX Spark, DGX Spark and DGX Station systems for edge and local deployments.

Enterprise applications connect their own rules

SAP is integrating the architecture with the Joule Studio runtime. ServiceNow announced availability of Arc, a long-running personal enterprise agent, with runtime actions governed by its control tower and enforced through OpenShell. NVIDIA lists security, infrastructure and model partners working on integrations, while banks including BBVA and Santander are exploring the architecture.

Those examples illustrate two different parts of adoption. An application understands its business objects and the permissions attached to them; the runtime controls what a process can reach. Combining those layers makes it possible to carry a business decision into an enforceable execution rule. For example, an agent assigned to summarise a contract could receive a bounded document-reading capability without acquiring a general administrative session.

An organisation evaluating that arrangement can map one real workflow from the user's request through the harness, model, tool and destination service. Each transition has a concrete identity and permission question. The resulting map is useful for deciding where a revoked entitlement must stop an action and where an audit record should be produced.

From a reference design to an operating service

NVIDIA says the reference architecture is available now. Its partner list includes hardware manufacturers, cloud operators, inference providers and enterprise software companies, reflecting a product that is intended to fit several deployment patterns.

For technology teams, the immediate deliverable is an architecture to examine alongside their existing identity, endpoint and application controls. The relevant comparison is the complete operating workflow: how a task receives credentials, how tools are confined, how monitoring reaches an operator and how access can be withdrawn during a session.

That makes OpenShell part of a wider transition in agent infrastructure. As companies move from brief chat interactions to persistent tasks, the execution environment becomes a managed product with its own lifecycle. Provisioning, policy changes, task completion and incident response need to work together for an agent to remain useful inside an enterprise.

Sources

- [NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents](https://nvidianews.nvidia.com/news/openshell-reference-architecture) — NVIDIA