NVIDIA has introduced the Open Agent Safety Platform, an architecture designed to keep increasingly autonomous AI agents within predefined boundaries. Rather than relying primarily on instructions given to the AI model, NVIDIA wants safety rules to be enforced independently at the software, infrastructure and ultimately hardware level. The approach is also intended for physical AI, where agents may control robots and other systems capable of taking actions in the real world.
As AI agents gain access to computers, corporate systems and physical machines, the question of how much freedom they should be given is becoming increasingly important. Agents can already write and execute code, access files, call APIs, use credentials and operate other software. In robotics, similar agentic systems are increasingly being connected to machines that perceive and act in the physical world. NVIDIA’s answer is to treat the agent itself as something that should not necessarily be trusted to remain within its instructions.
The company has launched the NVIDIA Open Agent Safety Platform, combining an open-source secure runtime called OpenShell with a reference architecture called Sentry. Together, these are intended to place independent controls around AI agents from development and testing through deployment. The underlying principle is relatively straightforward: telling an AI agent what it is allowed to do is different from technically preventing it from doing something else.
From guardrails to containment
Much of the discussion around AI safety has so far centred on models themselves. Developers train models to avoid particular behaviours, add system instructions and use filters or additional models to inspect prompts and responses. That becomes more complicated when a model turns into an agent. An agent does not only generate an answer, but can repeatedly reason about a task, select tools, execute commands, observe the result and decide what to do next. An agent may therefore perform hundreds or thousands of individual actions while pursuing a single objective.
NVIDIA argues that this creates a security problem similar in principle to the one encountered during the development of the web. Modern browsers do not simply ask websites to behave responsibly; they isolate websites and processes so that malicious or faulty code has limited access to the underlying computer. NVIDIA wants a comparable security boundary around AI agents, with restrictions that exist outside the agent itself and cannot simply be ignored when the agent encounters an obstacle.
The company refers to one potential problem as agent drift. This does not necessarily mean that an AI system has become malicious. An agent might simply pursue an assigned objective in an unexpected way because instructions are ambiguous, a tool is unavailable or its first approach fails. A system instructed to complete a task may then search for an alternative route. If it has extensive permissions and sufficient autonomy, that alternative could involve resources its operator did not intend it to use. The more capable and persistent agents become, the more important that distinction becomes.
OpenShell creates the first boundary
The software foundation of NVIDIA’s approach is OpenShell, an Apache 2.0-licensed open-source project for running autonomous agents in isolated environments. OpenShell places individual agents in sandboxes and uses policies to define which resources they are allowed to reach. Those policies can cover files, processes, system calls, networks, APIs and credentials, with restrictions enforced outside the language model rather than merely included in its instructions.
OpenShell applies controls to file access, system calls and network connections while the agent is running, with network requests checked against policy before leaving the sandbox. Credential handling illustrates the difference between this approach and conventional AI guardrails. Instead of giving an agent unrestricted possession of a credential and instructing it not to expose it, OpenShell can insert credentials only when a request is being made to an approved destination. The intention is therefore to design the environment so that the agent cannot freely use the secret elsewhere, regardless of what the model decides to do.
OpenShell also includes mechanisms for checking proposed changes to policies. NVIDIA says these can identify additional access that a change would provide, such as permission to contact a new host with credentials or invoke another API method. Potentially risky extensions can then be held for human approval. The software is not restricted to a single model provider and is positioned as a runtime around agents using both open and closed models.
Hardware adds another layer
NVIDIA is adding a second layer beneath OpenShell with Sentry, a reference system design running on NVIDIA BlueField-4 data processing units. Instead of operating alongside the agent on the same host processor, Sentry runs in a separate hardware domain. That separation is central to the architecture because, if the software environment running an agent is compromised, security software operating within the same environment could potentially also be affected.
Sentry uses NVIDIA’s DOCA software framework to inspect agent requests and responses, verify identities, monitor access to data and tools and enforce zero-trust policies. NVIDIA says the system can quarantine an agent within milliseconds if it attempts to operate outside its permitted boundaries. The company describes this approach as in-silicon enforcement, effectively creating an independent observer that does not rely on the agent itself to respect the rules.
In NVIDIA’s Vera Rubin POD architecture, BlueField-4 DPUs occupy the path between the agent and the model. NVIDIA argues that this is a useful observation point because an agent needs to communicate with the model to obtain its next inference. Monitoring that path provides a separate layer from which activity can be observed and, when necessary, interrupted. Organizations do not have to deploy every component: OpenShell can operate independently, while Sentry adds the hardware-based monitoring and enforcement layer.
Physical AI raises the stakes
The approach has particular implications for robotics. An autonomous software agent with excessive permissions can delete files, expose data or interact with an unauthorized service. A physical AI agent can potentially translate a software decision into movement or another action in the real world. That does not mean today’s robots are about to start circumventing their safety systems, and industrial robots already operate under established functional-safety architectures, but the distinction between conventional robot programming and agentic control is becoming increasingly relevant.
Physical AI models are being developed to interpret natural-language instructions, perceive their surroundings and plan sequences of actions. Instead of engineers explicitly programming every movement, an AI system can increasingly determine how a task should be accomplished and invoke the capabilities available to it. As that autonomy increases, a robot may face the same basic problem as a software agent: what should happen when the obvious route to completing an assignment does not work?
An agent could try another tool, another data source or another sequence of actions. In a physical system, however, the consequences of such experimentation may extend beyond a computer. This creates a case for separating the intelligence that decides what to do from the infrastructure that determines what it is permitted to do.
NVIDIA explicitly includes robotics in the Open Agent Safety Platform and says robotics developers including Figure, Gecko Robotics and Skild AI are working with OpenShell to add agent safety controls to autonomous systems operating in the physical world. For robotics, this could eventually provide another layer alongside conventional machine and functional safety. A robot’s existing safety controller might still prevent unsafe speed, force or motion, while an agent policy determines which data, software tools, services or machine capabilities its AI controller is authorized to use.
These are different safety problems and should not be confused. NVIDIA’s platform does not replace emergency stops, safety PLCs, collision avoidance or the safety requirements applying to industrial machinery. It addresses the behaviour and permissions of the AI agent that may increasingly sit above those systems.
The agent does not control the rules
One of the central ideas behind the architecture is that the entity being controlled should not also control its own safety boundaries. NVIDIA’s principles for agent safety therefore call for policies that can be verified before an agent starts, enforcement outside the agent and increasing oversight as an agent receives greater authority. Responsibility is also distributed between model developers, enterprises and infrastructure providers rather than placed entirely with the AI model.
This moves part of AI safety away from being purely a model-development problem. A sufficiently capable model may understand that it should not access a particular server, but infrastructure enforcement means that even if the agent decides to try, the request can still be blocked. The approach resembles familiar zero-trust principles in cybersecurity, where access is explicitly defined and enforced rather than granted simply because software is operating inside a trusted environment.
Human approval can remain part of this architecture. An agent might start with restricted access and discover that completing a task requires another database, API or tool. Rather than automatically expanding its permissions, it can request additional authority and leave the decision to another system or a person. NVIDIA and Salesforce, for example, have integrated OpenShell with Slack so teams can see agent activity and audit events and approve or reject requests for additional permissions. SAP is embedding OpenShell into the Joule Studio runtime, while Anthropic and NVIDIA are working on combining the architecture with Claude Managed Agents.
Broad industry involvement
NVIDIA is presenting the initiative as an ecosystem rather than solely as another proprietary security product. According to the company, more than 100 organizations are working with technologies associated with the Open Agent Safety Platform. The list includes Anthropic, Cisco, CrowdStrike, Dell Technologies, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Red Hat, Salesforce, SAP, Scale AI and ServiceNow, as well as infrastructure and robotics companies.
The company is also linking the initiative to the Open Secure AI Alliance, governed by the Linux Foundation, and says the broader effort is intended to support open research, tools and mechanisms for sharing security findings. OpenShell itself is open source and NVIDIA says it can be extended to third-party compute platforms, including Arm and Intel. The complete Sentry reference architecture, however, is more closely connected to NVIDIA infrastructure through BlueField-4 and DOCA.
Safety becomes an infrastructure question
The announcement illustrates a broader change taking place as generative AI develops into agentic AI. With a chatbot, much of the safety discussion concerns what information the model produces. With an agent, the question increasingly becomes what the software is allowed to do. That changes the technical requirements because a model refusing to perform an action is only one safeguard. A policy engine preventing the action provides another, while an independent hardware component capable of observing and interrupting the agent adds another layer again.
There is also a commercial dimension. If AI agents become an important computing workload, security infrastructure for running them could become part of the underlying data-centre architecture. NVIDIA is therefore positioning not only its GPUs, but also Vera CPUs, BlueField DPUs, DOCA software and agent runtime technology as components of an emerging agent computing stack.
At the same time, the effectiveness of the architecture will ultimately depend on implementation. Organizations still have to define appropriate policies. An incorrectly configured policy can give an agent more authority than intended, while an overly restrictive policy could prevent it from completing useful work and create frequent requests for human intervention. There is also an important distinction between enforcing permissions and understanding whether behaviour is appropriate: an agent may still perform an undesirable action using only resources it was legitimately authorized to access.
NVIDIA describes Sentry as capable of detecting attempts to leave predefined boundaries and quarantining agents within milliseconds, but these performance and security claims currently come primarily from NVIDIA itself. Independent evaluations of the complete platform under production conditions will be needed to establish how it performs against sophisticated agent escape attempts, policy errors and unexpected behaviour.
A new layer between AI and the real world
Despite those open questions, the Open Agent Safety Platform points to an important change in how autonomous AI systems are being designed. The first generation of generative AI safety largely concentrated on controlling what a model would say. Agentic AI adds another question: what happens when the model can act?
NVIDIA’s approach assumes that even a well-trained agent can make an unexpected decision. Instead of requiring the model to police itself, OpenShell establishes boundaries around what it can reach, while Sentry is intended to provide an independent hardware layer capable of observing and interrupting its activity. For software agents, that means containing access to files, credentials, networks and tools. For physical AI, the same principle could increasingly apply to the resources and capabilities through which an AI system interacts with machines and the physical world.
As robots become more capable of interpreting objectives and deciding for themselves how to achieve them, that separation could become an increasingly important addition to conventional robot safety: the AI can decide what it wants to do, but a separate layer decides whether it is allowed to do it.
