THE WORLD IS NOT STANDING STILL.RSS
BIG CHANGE.
BIG CHANGE, one tap away
BIG CHANGE, one tap away

Make room for the big picture.

Add BIG CHANGE to your home screen or desktop. It opens in its own window, with the latest stories when you’re online.

iPhone & iPad
Open bigchange.ai in Safari. Tap Share, then Add to Home Screen. Turn on Open as Web App if shown, then tap Add.
Android
Open bigchange.ai in Chrome. In the browser menu, choose Install app or Add to Home screen.
Desktop
In Chrome or Edge, use the install icon in the address bar or the browser’s app menu. In Safari on Mac, choose File → Add to Dock.

Markdown edition

# OpenShell moves toward community governance at CNCF

> NVIDIA contributes its agent runtime; Cedar remains in development.

By BIGCHANGE.AI Editorial

Published: 2026-11-13T08:43:38.183Z
Updated: 2026-11-13T08:43:38.183Z
Canonical: https://bigchange.ai/blog/openshell-cncf-community-governance

![Illustration of developers reviewing an agent policy.](https://bigchange.ai/api/media/file/policy-v2.png)
AI-generated illustration for BIG CHANGE.

On November 10, [NVIDIA and CNCF announced](https://www.cncf.io/blog/2026/11/10/welcoming-openshell-to-the-cncf-open-governance-to-secure-agentic-ai/) OpenShell's contribution to community governance.

OpenShell is a runtime that restricts AI agents' access. A sandbox is a constrained environment in which an agent can run, with access to the files or services its work requires.

## The big change

- NVIDIA will continue engineering as OpenShell moves to the ai-openshell organization. The joint announcement plans working groups and invites contributions to isolation, logging and integrations.
- OpenShell is adopting Cedar for authorization policies. NVIDIA's November 9 note limits Cedar to development builds: stable builds reject it, and integration remains under review.
- A policy narrows what a tool may request, but operators must choose appropriate permissions and check their deployment. A rule only enforces the boundary it expresses.

## What changes in governance

[CNCF records](https://www.cncf.io/projects/openshell/) Sandbox acceptance on September 26, before November's announcement. Sandbox is an early maturity level, not a certification that deployments are audited or production-ready.

Community governance offers a place to propose and inspect changes; it does not establish independent security results.

[NVIDIA's September platform announcement](https://nvidianews.nvidia.com/news/open-agent-safety-platform) paired OpenShell software with a separate Sentry hardware reference design. November's donation announcement concerns OpenShell, not a demonstrated Sentry deployment.

## A policy for a specific job

The [research note's](https://nvidia.github.io/OpenShell-Research/dev-notes/posts/2026-11-09-cedar-policy-language/) issue-triage example permits adding labels in one GitHub repository without authorizing comments, closing issues or code changes. It separates permission to connect from permission for a particular request. A token supplies credentials; policy still determines which operations are allowed.

That makes the job's boundary concrete: contacting GitHub is not blanket permission to change its contents. This is a documented design, not a BIG CHANGE test.

Existing YAML policies use Rego; OpenShell's current prover checks modeled YAML permissions. Extending that prover to Cedar remains future work. Policy inclusion asks whether one policy allows any request another forbids; it does not prove the agent's answers correct.

## What teams still have to decide

The [public repository](https://github.com/NVIDIA/OpenShell) describes kernel controls over files and system calls, with policy checks before network connections leave the sandbox. These controls operate around the agent rather than relying on its willingness to follow an instruction.

Its quickstart lists Linux, Apple Silicon macOS and experimental Windows via WSL 2, plus a supported runtime. The installer sets up a CLI and local gateway; the default sandbox has no agent installed. Teams therefore need to check release-specific setup and agent requirements, not assume installation delivers a working agent.

Before relying on a release, test permitted and forbidden actions and review how permissions change. Those checks address the configured deployment; they do not turn a policy into a guarantee against every failure.

## Sources

- [CNCF announcement](https://www.cncf.io/blog/2026/11/10/welcoming-openshell-to-the-cncf-open-governance-to-secure-agentic-ai/) — Donation and community plans.
- [CNCF project listing](https://www.cncf.io/projects/openshell/) — Sandbox acceptance date.
- [Cedar research note](https://nvidia.github.io/OpenShell-Research/dev-notes/posts/2026-11-09-cedar-policy-language/) — Policy example, development status and planned prover.
- [OpenShell repository](https://github.com/NVIDIA/OpenShell) — Documented policy controls.
- [September platform announcement](https://nvidianews.nvidia.com/news/open-agent-safety-platform) — Earlier launch context.