# NVIDIA's agent safety platform has a software boundary and an optional hardware watchdog
> OpenShell puts access controls around AI agents. NVIDIA's optional Sentry design adds monitoring on BlueField-4, though its speed and effectiveness remain vendor claims.
By BIG CHANGE Editorial
Published: 2026-09-28T21:34:31.964Z
Updated: 2026-09-28T21:34:31.964Z
Canonical: https://bigchange.ai/blog/nvidia-open-agent-safety-platform-agent-controls
AI-generated conceptual illustration by BIG CHANGE.
NVIDIA announced its Open Agent Safety Platform on September 28, 2026, as a way to put controls around AI agents that can run code and call outside services. The name covers two separable pieces. OpenShell is a public, open source runtime that applies access policies around an agent. Sentry is a reference design for additional monitoring and enforcement on a BlueField-4 data processing unit. A team can use OpenShell without BlueField hardware, according to NVIDIA's [platform FAQ](https://www.nvidia.com/en-us/solutions/ai/agent-safety/).
OpenShell has public code, documentation and release packages. NVIDIA describes Sentry's ability to quarantine an agent in milliseconds, but the announcement does not provide an independent measurement or a public Sentry setup procedure that would let a reader verify that result.
## The big change
NVIDIA is combining a software runtime that enforces declared permissions outside an agent's process with an optional hardware layer that, in its reference design, watches the agent from a separate trust domain. The software can restrict file access, process privileges and outbound requests even when an agent runs a shell or generated code. The hardware layer is intended to keep monitoring and policy enforcement separate from the host running the agent. This gives operators a more concrete boundary than an instruction to the model, provided they configure the policy correctly. It does not establish that the combined system prevents every unsafe action.
## What OpenShell controls
NVIDIA's [OpenShell 0.1.0 technical walkthrough](https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell/) describes a gateway that manages sandboxes and their policies, a supervisor outside each agent workload that checks outbound requests, and a sandbox with kernel controls over files and processes. Network traffic goes through the supervisor. For configured HTTP, GraphQL and Model Context Protocol traffic, policy can distinguish an allowed read from a blocked write to the same service. NVIDIA says the decisions can be recorded in an OCSF audit trail.
Policies are written in YAML. The walkthrough's documented demonstration starts with a sandbox that has no outbound network access, then applies a replacement policy allowing `curl` to read from the GitHub REST API while blocking a POST. That is a vendor-documented procedure, not a BIG CHANGE test. NVIDIA also documents a policy advisor through which an agent may propose additional access. A human must approve by default; an agent cannot approve its own proposal. Network policy can change while the sandbox runs, while changing filesystem or process restrictions requires a new sandbox.
The walkthrough says a policy prover checks modeled permissions against an operator-defined boundary and can show an action that exceeds it. The result depends on the policy model and the boundary chosen; it does not prove the agent itself safe. NVIDIA reports adversarial experiments involving agents seeking permission to write to a protected repository. Those company-reported results do not measure real-world performance of the whole platform.
## What Sentry adds
NVIDIA describes [Sentry](https://developer.nvidia.com/blog/nvidia-open-agent-safety-platform-a-reference-for-continuous-in-silicon-agent-monitoring/) as an optional watchdog on a BlueField-4 DPU. In the reference design, NVIDIA's DOCA software connects the separate hardware domain to OpenShell policy, correlating agent interactions, policy decisions and tool or data access. NVIDIA says this position can support identity checks, detection and intervention even if host software is compromised. Its claim of millisecond quarantine is a vendor performance claim in the [launch release](https://nvidianews.nvidia.com/news/open-agent-safety-platform), without a published test method or independent result in the sources reviewed here.
The product page explicitly says OpenShell runs on supported local, on-premises, cloud and Kubernetes infrastructure without BlueField-4. BlueField-4 is relevant to the additional Sentry design. NVIDIA lists more than 100 organizations working with its platform technologies and names integrations or collaborations at different stages. Participation does not show that Sentry is deployed across those organizations or that the controls have stopped incidents.
## Access and limits for a team evaluating it
The [OpenShell repository](https://github.com/NVIDIA/OpenShell) is public under Apache 2.0. NVIDIA's September 28 walkthrough focuses on version 0.1.0; the [release page](https://github.com/NVIDIA/OpenShell/releases) listed v0.1.2 on September 28 when we checked, so teams should pin a version and use matching documentation. The [installation guide](https://docs.nvidia.com/openshell/latest/about/installation) describes installing the CLI and local gateway and selecting a supported runtime. The [support matrix](https://docs.nvidia.com/openshell/latest/about/support-matrix) lists Docker, Podman, Kubernetes and MicroVM runtimes with their host requirements; Windows through WSL 2 with Docker Desktop is marked experimental. Running an AI agent can also require the relevant model provider's credentials.
OpenShell's code is available without a published OpenShell license fee in these sources. Compute, model API and enterprise deployment can still carry costs. The reviewed NVIDIA material does not give a Sentry price, a BlueField-4 system price or a public Sentry installation path. Teams would need those details, along with deployment requirements and the scope of monitoring, before evaluating the hardware design as a purchasable control.
### Sources & further reading
- [NVIDIA's September 28 announcement](https://nvidianews.nvidia.com/news/open-agent-safety-platform) establishes the launch, product descriptions and named collaborations. Its performance and effectiveness statements are NVIDIA claims.
- [NVIDIA's OpenShell 0.1.0 walkthrough](https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell/) documents the components, policy example and permission-change flow. The example was not tested by BIG CHANGE.
- [OpenShell code and releases](https://github.com/NVIDIA/OpenShell) show public availability, the Apache 2.0 license and release history; the [installation guide](https://docs.nvidia.com/openshell/latest/about/installation) and [support matrix](https://docs.nvidia.com/openshell/latest/about/support-matrix) give current prerequisites.
- [NVIDIA's Sentry architecture article](https://developer.nvidia.com/blog/nvidia-open-agent-safety-platform-a-reference-for-continuous-in-silicon-agent-monitoring/) explains the proposed BlueField and DOCA layer. It is vendor-authored and does not independently establish efficacy or price.
## Sources
- [NVIDIA Newsroom, Open Agent Safety Platform announcement](https://nvidianews.nvidia.com/news/open-agent-safety-platform) — Launch and company claims, including millisecond quarantine and partner participation; no independent efficacy evidence.
- [NVIDIA Open Agent Safety Platform](https://www.nvidia.com/en-us/solutions/ai/agent-safety/) — Vendor architecture and FAQ: OpenShell does not require BlueField-4.
- [Add Runtime Controls to AI Agents with NVIDIA OpenShell](https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell/) — Vendor guide for OpenShell 0.1.0 components, YAML policy, review flow and prover; no BIG CHANGE test.
- [NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring](https://developer.nvidia.com/blog/nvidia-open-agent-safety-platform-a-reference-for-continuous-in-silicon-agent-monitoring/) — Vendor description of optional Sentry, DOCA and BlueField-4 reference design.
- [NVIDIA OpenShell repository](https://github.com/NVIDIA/OpenShell) — Public code and Apache 2.0 license.
- [NVIDIA OpenShell releases](https://github.com/NVIDIA/OpenShell/releases) — Release page listed v0.1.2 on September 28; tutorial describes v0.1.0.
- [OpenShell installation guide](https://docs.nvidia.com/openshell/latest/about/installation) — Canonical installation documentation for CLI and local gateway; checked September 28.
- [OpenShell support matrix](https://docs.nvidia.com/openshell/latest/about/support-matrix) — Canonical runtime and host support documentation; WSL 2 with Docker Desktop marked experimental.
The BIG CHANGE newsletter
The big picture. At your pace.
Recent stories on AI and robotics, the shifts worth watching and practical ideas to use. Choose a daily briefing, weekly digest or monthly perspective.
Next scheduled send (UTC): . Your first edition arrives at the next scheduled send after you confirm.
Your privacy, your choice.
Necessary storage supports site security and remembers your choices. Optional Google Analytics stays off until you allow it. You can read every story with necessary storage only. Privacy details