NVIDIA Debuts OpenShell Reference Architecture for Agent Governance

NVIDIA announced the OpenShell Reference Architecture on October 21, 2026, at GTC Berlin, a full-stack design for building, containing, observing and enforcing safe AI agents across enterprise infrastructure and edge systems. The architecture is available now.

The architecture builds on NVIDIA’s open-source OpenShell secure runtime software, extending it into industrial-scale infrastructure for agent development and operations. It combines Vera Rubin infrastructure for running enterprise workloads, including closed and open models built with NVIDIA Nemotron; Vera CPUs for operating agent harnesses; and BlueField-4 DPUs running NVIDIA Sentry, a security framework that provides continuous out-of-band monitoring of agent behavior and in-silicon policy enforcement. The design extends to agents running at the edge on RTX Spark, DGX Spark and DGX Station systems across retail, healthcare, manufacturing, robotics, software development and telecommunications.

“With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField,” said Jensen Huang, founder and CEO of NVIDIA. Huang said safety and control must be built into the computing architecture as enterprises prepare to deploy billions of AI agents.

Full-Stack Infrastructure for Agent Workloads

At the core of the Vera Rubin infrastructure sit Vera Rubin NVL72 systems, which NVIDIA describes as fungible across pretraining, post-training and inference. The company states the NVL72 delivers 30x higher throughput per megawatt for agentic workloads. Vera CPUs run the OpenShell software that provides a secure runtime boundary for autonomous agents, and NVIDIA states they deliver 2x the performance of x86 processors with greater energy efficiency.

A companion technical post describes Vera as a CPU built on 88 NVIDIA-designed Olympus cores with a second-generation Scalable Coherency Fabric, 96 lanes of PCIe Gen 6 and up to 1.2 TB/s of LPDDR5X memory bandwidth. NVIDIA states the fabric provides up to 3x core-to-core bandwidth and up to 50% lower core-to-core latency than x86 alternatives, and that Vera delivers 2x more performance per watt than x86 CPUs.

CoreWeave, an AI cloud platform, measured sandbox startup at more than 3x faster on Vera than on x86, with a single rack supporting more than 11,000 concurrent agent environments, according to the post. Running Terminal Bench, which measures CPU performance across real agentic loop tasks, CoreWeave found Vera delivered 1.8x faster performance versus x86 across tasks ranging from scripting to database recovery.

BlueField-4 DPUs running Sentry, built on NVIDIA’s DOCA software, continuously monitor agent behavior. If an agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds, according to NVIDIA. The company also states that Sentry on BlueField-4 boosts agent capacity by up to 20%.

How OpenShell and Sentry Enforce Agent Boundaries

NVIDIA’s position, stated in its technical post, is that an agent cannot govern itself, so security and governance belong in the infrastructure the agent operates in. OpenShell treats agent workloads as untrusted throughout execution, giving an agent access to what it needs only when it needs it. The runtime has four components: Gateway, a control plane that manages sandbox lifecycles and policies; Supervisor, which checks outbound requests against policy and mediates access to credentials while running completely separate from the sandbox; Sandbox, which isolates the agent workload and restricts filesystem and process access; and Policy Prover, which applies formal verification to check whether a policy’s permissions stay within an organization-defined ceiling.

In the reference architecture, agents execute on Vera CPUs while BlueField-4 sits on the node’s only path to the model, so Sentry inspects agent-to-model communications without relying on the agent to report its own behavior, according to a technical deep dive on the framework. Sentry operates from a hardware-isolated trust domain independent of host software and is designed to retain monitoring and enforcement capabilities even if an agent escapes its sandbox or the host is compromised.

DOCA Tower, Sentry’s AI security gateway built on the open-source Envoy proxy, acts as a transparent proxy for agent traffic and terminates TLS in silicon. DOCA Flow implements a layer-4 firewall for each agent, accelerated in silicon, blocking connections to unauthorized destinations and forwarding permitted traffic to DOCA Tower for application-layer inspection and authorization. Access requests are evaluated against defined policies with the Open Policy Agent engine, which uses the Rego language and can evaluate requests in under a millisecond, depending on policy complexity and configuration.

DOCA Argus adds runtime context through agentless live memory introspection, analyzing selected regions of volatile host memory from BlueField-4 without host-resident agents. It maps containers to their pods and sandboxes to microVMs and tracks processes, file access, network connections and loaded libraries by hash, allowing policies such as requiring a container’s hash to match an approved list or requiring an initiating process to appear in the container’s software bill of materials. Warning signs Sentry evaluates include execution of unapproved tools, use of ptrace to attack another process, excessive outbound traffic, unauthorized file access or changes, CPU spikes, excessive writes to temporary folders and large-scale file deletion. On detecting a deviation, Sentry can request millisecond-scale in-silicon containment.

Sentry also works with specialized AI models that classify agent communications inline or out of band to identify behavioral drift, and it produces attested, tamper-evident records on BlueField-4 that support forensic investigation and export to enterprise security platforms such as XDR and SIEM systems. DOCA Tower integrates SPIFFE/SPIRE for verifiable workload identity. NVIDIA plans Sentry availability early next year; DOCA libraries and microservices including DOCA Argus, DOCA Flow and OVS-DOCA are available now for experimentation.

Partner Ecosystem and Availability

The OpenShell Reference Architecture runs on Linux and Kubernetes infrastructure from Canonical, SUSE and Red Hat, on Microsoft Windows using Microsoft Execution Containers, and on cloud operating systems from Amazon Web Services, Google Cloud and Microsoft Azure. Enterprises can run agents from model builders Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection and SpaceX Super Intelligence on OpenShell infrastructure.

Cybersecurity vendors 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI and Zscaler are integrating support for the architecture into their agent security products. Banks BBVA and Santander are working with NVIDIA to explore the architecture as a framework for strengthening agent safety, security and governance. Enterprise software companies Cadence, Dassault Systèmes, IBM, SAP, Siemens and Synopsys are working with OpenShell to build agent software platforms, and Palantir and NVIDIA are working with customers to deploy secure agents in production.

SAP is integrating the architecture with its Joule Studio runtime, part of the SAP Business AI Platform. ServiceNow announced the general availability of ServiceNow Arc, a personal long-running AI agent with actions governed at runtime by the ServiceNow Super Intelligence Control Tower and enforced by OpenShell; ServiceNow’s AI Passport authority layer carries those policies to OpenShell and Sentry, so enterprises can revoke an agent’s access across software and hardware within seconds.

System manufacturers Dell Technologies, Cisco, HPE, Lenovo and Supermicro are building infrastructure with the architecture. Cloud providers CoreWeave, Crusoe, Firebird, Firmus, GMI Cloud, IREN, Lambda, Nebius, Nscale, Oracle Cloud Infrastructure and Vultr are working with NVIDIA to deploy OpenShell-ready infrastructure, and inference and post-training providers Baseten, Deepinfra, Fireworks and Together AI are building integrations into their model development pipelines.

The architecture’s availability notice points to the Secure Agent Workspace Reference Design documentation, which covers seven logical planes, a security and governance model, deployment tiers, and reference implementations for Red Hat OpenShift Virtualization and Microsoft Azure. OpenShell’s code is available on GitHub.