- NVIDIA announced the OpenShell Reference Architecture, which runs AI agents inside a software boundary and monitors them from a separate hardware layer.
- The design rests on a familiar principle: the party doing the work should not be the one checking it. The speed and capacity figures are NVIDIA's own.
- Before adopting any agent platform, ask who writes the boundary rules, how fast access can be revoked, and which layers are open.
The guard should not live inside the thing it guards
Banks separate the person who moves money from the person who checks the ledger. Aviation separates the pilot from the flight recorder. The reasoning is the same in both cases. Oversight is weak when the watched party can edit it.
NVIDIA's new design for AI agents applies that logic to software that acts on its own. NVIDIA announced the OpenShell Reference Architecture at GTC Berlin. The company says it helps enterprises build, contain, observe and enforce safe agents on company infrastructure and edge systems.
The lesson for executives is about structure. As agents take real actions, control has to sit apart from the agent.
How the three layers work
NVIDIA splits the work across three parts. Jensen Huang, NVIDIA's CEO, put it this way: agents "think on Rubin, act on Vera and be governed on BlueField."
Vera Rubin systems run the AI models. That is the thinking.
Vera CPUs run the agent harness. That is the software that manages an agent and its use of tools. The same CPUs run OpenShell, an open source runtime. NVIDIA describes it as a boundary around what an agent may do. That is the acting.
The third layer is oversight. It runs on BlueField-4 chips, which NVIDIA calls data processing units. Each hosts a security program named Sentry, powered by NVIDIA's DOCA software.
NVIDIA says Sentry watches agent behaviour from outside the agent's own environment. It calls this out-of-band monitoring. It also describes in-silicon enforcement. That means the hardware itself applies the rules.
NVIDIA says an agent that tries to leave its software boundary is quarantined and stopped in milliseconds. It also says Sentry on BlueField-4 can raise agent capacity by up to 20%.
Who is building on it
NVIDIA lists a long set of partners. It says eleven security companies are adding support to their own agent products. They include CrowdStrike, Palo Alto Networks, Okta, Microsoft and Zscaler. Dell, Cisco, HPE, Lenovo and Supermicro are building infrastructure around the design.
The design runs on Linux and Kubernetes from Canonical, SUSE and Red Hat. It also runs on Windows through Microsoft Execution Containers. Cloud options include AWS, Google Cloud and Azure.
On the model side, NVIDIA says agents from Anthropic, OpenAI, Google and Meta can run on it. Cohere, Perplexity, Reflection and SpaceX Super Intelligence are also on its list.
ServiceNow announced general availability of ServiceNow Arc, a long-running personal AI agent. Its actions are governed by ServiceNow's Control Tower and enforced by OpenShell. NVIDIA says ServiceNow's AI Passport layer passes those policies to OpenShell and Sentry. That lets enterprises revoke an agent's access across software and hardware within seconds.
Banks are at an earlier stage. NVIDIA says BBVA and Santander are exploring the design as a framework for agent safety, security and governance. Exploring is not deploying.
What the announcement does not show
This is a vendor announcement. The milliseconds, the seconds and the 20% are all NVIDIA's figures. The material provided cites no independent test. It gives no test conditions and no customer results.
NVIDIA's own notice adds a caution. It says many features will be offered on a "when-and-if-available" basis. The notice says this is not a commitment. The architecture is described as available now. Ask NVIDIA and your integrator which parts are ready for production.
A hardware monitor also does not decide what is allowed. Someone still has to write the boundary. Which systems can an agent touch? Which actions need a human? Which data stays out of reach? Strong enforcement of a poorly drawn boundary is still a poorly drawn boundary.
Questions to put to your team
First, who owns the boundary? Name the person who approves what each agent can do. Ask how often that is reviewed.
Second, can access be pulled quickly? NVIDIA says ServiceNow's AI Passport enables revocation within seconds. Ask vendors to show it working on your systems.
Third, where does monitoring run? If the watcher shares an environment with the agent, ask what that means for trust. NVIDIA's pitch is a separate layer.
Fourth, how tied are you to one supplier? OpenShell is open source. But the reference design names NVIDIA hardware at each layer. Ask which pieces work without it.
Fifth, who has tested it? Ask for results from your own security team or a third party before trusting a vendor's timing claims.
NVIDIA's design answers a real question: what stops an agent that goes beyond its brief? The idea that oversight should sit outside the agent is sound. The material provided offers no independent proof yet that this version delivers.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: NVIDIA.
