NVIDIA Releases OpenShell Reference Architecture, Governing Agent Security with a Three-Layer Approach
NVIDIA has released the OpenShell reference architecture, arguing that Agents cannot govern themselves and that security and governance should be placed at the infrastructure layer, which Agents cannot reach. The approach has three layers: the open-source runtime OpenShell defines permission boundaries through Gateway, Supervisor, Sandbox, and a formally verified Policy Prover; Vera CPU provides 88 Olympus cores and 1.2 TB/s memory bandwidth, with CoreWeave measuring sandbox startup more than 3x faster and Agent tasks on Terminal Bench 1.8x faster; BlueField-4 DPU plus Sentry provides optional hardware-level monitoring that can isolate violating Agents within a few milliseconds.
Why read this
AI score 70
The original article breaks Agent security governance into three layers—software sandbox, CPU, and DPU—and provides formal verification and measured figures, making it easier to judge the feasible boundaries of infrastructure-layer protection.
Topics
Body · AI translation
NVIDIA OpenShell Reference Architecture: Handing Agent Security Governance to Infrastructure, from Software Sandboxes All the Way to Chip-Level Isolation
Long-running Agents download code on their own, build tools, request more permissions, and decide their execution path while reasoning, so risk keeps accumulating. Based on this, NVIDIA's core claim is that "Agents can't govern themselves"—security and governance must be placed in infrastructure the Agent cannot touch. NVIDIA therefore offers a three-layer solution: the open-source runtime OpenShell handles permission boundaries at the software level, the Vera CPU handles high-concurrency Agent execution, and the BlueField-4 DPU plus Sentry provide optional hardware-level monitoring and isolation. https://t.co/3onRr3hjN2
Layer 1: OpenShell (open-source runtime, deterministic governance). It treats the Agent's workload as an untrusted object throughout, granting only the permissions needed when needed. It contains four components: · Gateway: the control plane, managing sandbox lifecycles and policies. · Supervisor: runs independently of the sandbox, checks all outbound requests against policy, and manages credentials on the Agent's behalf. · Sandbox: isolates workloads and restricts file system and process access. · Policy Prover: uses formal verification to prove that a given policy's permissions will not exceed the limits set by the organization. This is the most distinctive point.
There are two ways to extend it: Supervisor middleware can inspect, intercept, or rewrite network content; Gateway interceptors can connect to existing enterprise systems such as identity, authorization, data protection, and auditing.
Layer 2: Vera CPU (the compute foundation for the Agent loop). The Agent loop (reasoning, calling tools, executing code) is completed serially, step by step, so it needs both many cores to run large numbers of concurrent tasks and each core to be fast enough. The vendor's figures: 88 Olympus cores, up to 2x the performance of x86 on key Agent workloads; 1.2 TB/s memory bandwidth; 2x the performance per watt of x86. CoreWeave measured sandbox startup more than 3x faster, Agent tasks on Terminal Bench 1.8x faster, and a single rack able to run more than 11,000 Agent environments simultaneously.
Layer 3: BlueField-4 + Sentry (optional hardware defense line). The DPU sits on the I/O path between the Agent and the model, forming an independent hardware trust domain. Sentry monitors requests and responses, network and file activity in this domain, verifies identity and authorization, and analyzes host memory without relying on the Agent to report on itself. Once a violation is detected, it enforces policy at the chip level and isolates the Agent within a few milliseconds.