NVIDIA Open Agent Safety Platform puts limits around what agents can do

NVIDIA announced Open Agent Safety Platform on 28 September 2026. The name is real, but it describes a software platform and reference system design, not one new model or a single security switch. Its central idea is to give an AI agent only the authority needed for a task and enforce those limits outside the agent’s own instructions. The package brings together the OpenShell runtime and an optional Sentry layer designed for BlueField-4 hardware.

Imagine an agent asked to summarize support tickets. It may need to read tickets and write a report, but it does not need to export the customer database or change account settings. A sentence in its prompt can describe that boundary. The runtime is where the boundary can be enforced when an unexpected tool response, a prompt injection, or a mistaken plan leads the agent to attempt something else.

What OpenShell controls

OpenShell is NVIDIA’s open-source secure runtime. It runs agent workloads in sandboxes with kernel-level isolation. An operator sets policies for the files, network destinations, tools, processes and credentials an agent can use. The agent cannot grant itself a wider policy. NVIDIA says OpenShell checks policy before execution and enforces it while the agent works, with allow and deny decisions available for audit.

The newer technical walkthrough describes a gateway that manages sandboxes, a supervisor outside each workload that checks outbound requests, and a sandbox that applies filesystem and process controls. Its example distinguishes reading an API from writing to it: a policy can allow a read request and block a write request to the same service. It also keeps real service credentials outside the workload and binds them to approved requests. Those details matter because a simple list of approved websites would not express all the actions an agent can take once connected.

OpenShell can be used with open or closed models and existing agent frameworks. NVIDIA’s FAQ says it does not require BlueField-4 and can run on supported local, cloud, on-premises and Kubernetes infrastructure. The open-source runtime and the hardware reference design therefore have different adoption requirements.

What the hardware layer adds

NVIDIA calls Sentry an out-of-band watchdog on its BlueField-4 data processing unit. In the technical overview, OpenShell runs on the host side while the separate BlueField layer observes agent activity and enforces policy through DOCA. NVIDIA describes correlations among agent interactions, policy decisions, and tool and data access. That record is intended to reveal behavior drifting from a defined profile and support intervention or investigation.

For NVIDIA Vera Rubin POD systems, the company says BlueField-4 sits on the node’s path to the model. That placement is part of its argument for observation and enforcement outside the host software. The launch release says Sentry can quarantine an agent that moves beyond its boundary in milliseconds. This is NVIDIA’s product claim; the announcement does not provide an independently reproducible latency test, a measured false-positive rate, or results across arbitrary deployments. An organization would still need to test its own policy, workloads and failure modes.

The source also calls Sentry a reference system design and an optional additional layer. It should not be read as a feature that automatically appears whenever someone installs OpenShell. NVIDIA says the overall platform is optimized for Vera CPU and BlueField systems while remaining compatible with other hardware, but the specific independent BlueField enforcement described above depends on that hardware layer.

A useful boundary, with work left for operators

NVIDIA’s three-layer description separates the application (model, harness, tools and data), the runtime (sandbox and policy), and the infrastructure (compute and hardware controls). That separation is useful when evaluating the claim. Model safeguards can influence a proposed action; runtime and infrastructure controls determine whether it can reach a file, service or tool. None of those controls decides on its own which business action should be allowed. Teams must write policies, set credential scopes, retain logs and decide who may approve a request for more authority.

NVIDIA says OpenShell software and related resources are available through its developer documentation and GitHub links. The release also names enterprise and research collaborators. A listed collaboration or integration is not evidence that every proposed hardware configuration is already deployed, or that every kind of agent mistake can be prevented. For buyers and builders, the next practical check is to try a narrow task: grant only its required reads and writes, attempt a forbidden action, inspect the resulting audit trail, and measure the operational cost on the intended infrastructure. No independent platform test was performed for this article.