NVIDIA OpenShell Reference Architecture moves the controls for AI agents out of the agent and into the infrastructure around it, with an optional hardware layer in which NVIDIA Sentry software on a BlueField-4 DPU can quarantine a misbehaving agent within milliseconds, according to NVIDIA.
NVIDIA introduced the stack at GTC Berlin and says it is available now. It builds on OpenShell, the company's open-source secure runtime for agents, and maps each layer to NVIDIA hardware. Vera Rubin NVL72 systems run model inference, Vera CPUs run the agent harness and OpenShell itself, and BlueField-4 DPUs run NVIDIA Sentry, a security software framework that monitors agent behavior out of band. At the edge, the OpenShell Reference Architecture extends to RTX Spark, DGX Spark and DGX Station systems.
NVIDIA breaks OpenShell into four parts. A gateway manages sandbox lifecycles and policies. A supervisor, running apart from the sandbox, checks outbound requests against policy and mediates access to credentials. The sandbox restricts file and process access. A policy prover formally checks that a policy's permissions stay under a ceiling the organization sets. The design treats every agent workload as untrusted and grants access only when the agent needs it.
Sentry, the optional layer, runs on the DPU outside the agent's reach and watches requests and responses and network and file activity, verifies the agent's identity and delegated authority, and analyzes selected host memory. When it detects a policy violation, BlueField-4 enforces the policy in silicon. NVIDIA says Sentry also raises agent capacity by up to 20%. NVIDIA reserves the hardware layer for deployments that require additional protection and tells teams to begin with OpenShell, which is open source.
NVIDIA says Vera CPUs, built on 88 Olympus cores, deliver up to 2x the performance of x86 processors on critical agentic tasks. For Vera Rubin NVL72 systems it claims 30x higher throughput per megawatt on agentic workloads, without naming the system it compared them with. According to NVIDIA, cloud provider CoreWeave tested Vera against a leading x86 CPU and found sandbox startup more than 3x faster and Terminal Bench tasks finishing 1.8x faster. CoreWeave also found that a single rack could support more than 11,000 concurrent agent environments.
Security vendors 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI and Zscaler are integrating support for the OpenShell Reference Architecture into their agent security products. Banks including BBVA and Santander are exploring it as a framework for agent safety, security and governance, and SAP is integrating it with its Joule Studio runtime. NVIDIA says agents from model builders including Anthropic, OpenAI, Google and Meta can run on OpenShell infrastructure, on Linux from Canonical, SUSE or Red Hat, on Windows through Microsoft Execution Containers, and on AWS, Google Cloud and Azure.
ServiceNow has made ServiceNow Arc, a personal long-running AI agent, generally available, with its actions governed at runtime by the ServiceNow Super Intelligence Control Tower and enforced by OpenShell. ServiceNow's AI Passport layer carries those policies down to OpenShell and Sentry, so an enterprise can revoke an agent's access across software and hardware within seconds.
