How NVIDIA OpenShell Governs and Secures AI Agent Workloads at Scale

Autonomous agents can work for hours on complex tasks while accessing files, tools, internet services, and other agents. Long-running execution creates compounding risks: an agent may download code, build tools, request additional privileges, or access more of the underlying infrastructure.

An agent’s action path develops as it reasons through the steps required to achieve its goal. As it interacts with surrounding tools and systems, it can adapt its behavior. This flexibility makes agents powerful, but goal-oriented systems may not prioritize safety while pursuing their objectives.

Safe autonomy therefore requires environments that provide control and visibility over agent activity. An agent cannot govern itself. Security and governance must be implemented in the infrastructure where the agent operates.

OpenShell provides governance outside the agent’s control

NVIDIA OpenShell is an open-source runtime for incorporating security and governance into agentic computing infrastructure. It defines and enforces which systems and data an agent can access, including files, internet services, and systems connected to physical devices.

OpenShell serves as the foundation of the NVIDIA OpenShell Reference Architecture. The runtime treats agent workloads as untrusted throughout execution and grants access to required resources when they are needed.

OpenShell consists of four main components:

1. Gateway: The control plane that manages sandbox lifecycles and policies.
2. Supervisor: A separate component that checks outbound requests against policy and mediates access to credentials.
3. Sandbox: An isolated environment that restricts filesystem and process access for the agent workload.
4. Policy prover: A formal-verification component that checks whether a policy’s permissions remain within an organization-defined ceiling.

Together, these components provide infrastructure-level controls as agents change their behavior and execute tasks.

Extending and integrating OpenShell

Extensibility is a central design principle of OpenShell. Supervisor middleware can inspect, block, or modify the content an agent sends and receives over the network, creating an additional enforcement layer. Gateway interceptors allow operators to add deployment-specific governance to control-plane operations without changing the gateway itself.

Organizations also need to determine who an agent acts for, what authority it has, and whether a proposed action fits its assigned task. Identity, authorization, data protection, and auditing address different parts of this problem. OpenShell provides enforcement points for integrating those systems.

In the reference architecture, OpenShell runs on NVIDIA Vera CPUs.

NVIDIA Vera provides the compute layer

OpenShell defines what agents can do. Vera determines how quickly they can do it. Agent workloads consist of dependent loops in which reasoning, tool calls, code execution, and data queries must generally complete before the next step begins.

AI factories run thousands of these loops concurrently, creating five requirements for the CPU architecture:

1. Massive core counts are needed for concurrent workflows, along with fast individual cores to reduce the duration of sequential steps.
2. High-bandwidth fabric and memory are needed to keep cores supplied with the live data agents require.
3. High I/O capacity is needed to move data between CPUs, GPUs, storage, and networks.
4. Hardware-enforced security is needed because agents increasingly operate on sensitive enterprise data and must remain isolated from one another and from the host.
5. These capabilities must fit within the power envelope of a modern data center, providing more agent work per watt rather than only higher raw performance.

NVIDIA describes this combination as the max single-threaded CPU at scale. NVIDIA Vera is designed around this objective with Olympus cores, a second-generation Scalable Coherency Fabric, LPDDR5X memory, Gen 6 I/O, confidential computing, and an energy-efficient design for power-limited data centers.

Vera’s architectural properties for agent workloads

Three architectural characteristics are highlighted for agent workloads:

• Processing: Vera includes 88 NVIDIA-designed Olympus cores with a 10-wide front end, a neural branch predictor, and deep out-of-order execution. NVIDIA reports up to 2x performance on critical agentic workloads versus x86, reducing the time required for tool calls, code execution, and evaluation.
• Interconnect and I/O: Vera’s second-generation Scalable Coherency Fabric provides up to 3x the core-to-core bandwidth and up to 50% lower core-to-core latency than x86 alternatives. The processor also integrates 96 lanes of PCIe Gen 6 for connecting GPUs, high-speed storage, and networks.
• Memory and efficiency: Up to 1.2 TB/s of LPDDR5X memory bandwidth, with up to 40% lower loaded memory latency than chiplet-based designs, supplies agents with live context. NVIDIA reports that Vera delivers 2x more performance per watt than x86 CPUs. The LPDDR5X memory subsystem itself uses an order of magnitude less power than competing DDR5-based memory configurations.

Agent workloads depend on sandboxes, which provide isolated environments for running code, invoking tools, and completing tasks without interference between agents or with the host system. Faster and denser sandbox deployment allows a given infrastructure footprint to support more agent work.

CoreWeave, an AI cloud platform for training and serving models at scale, reported that sandbox startup was more than 3x faster on Vera than on x86. A single rack supported more than 11,000 concurrent agent environments.

In tests using Terminal Bench, which measures CPU performance across real agentic loop tasks, CoreWeave reported that Vera was 1.8x faster than x86 across tasks ranging from scripting to database recovery. The test covered 20 agentic loop tasks, including cobol-modernization, fix-git, db-wal-recovery, and openssl-selfsigned-cert.

Figure 1. CoreWeave reported that NVIDIA Vera delivered more than 3x faster sandbox startup and 1.8x faster agentic loop completion than a leading x86 CPU across 20 real-world agent tasks.

NVIDIA BlueField and NVIDIA Sentry add hardware-enforced protection

OpenShell places authority outside the agent. Deployments requiring an additional protection layer can extend this separation into dedicated hardware.

NVIDIA BlueField-4 DPUs provide a hardware-isolated trust domain outside the agent’s reach. In the OpenShell reference architecture, BlueField-4 sits in the I/O path between agents running on Vera and the models they access. NVIDIA Sentry, a security software framework built on NVIDIA DOCA, runs in this independent domain to monitor agent behavior and enforce runtime policy.

NVIDIA Sentry observes requests and responses, network and file activity, identity and delegated authority, and selected host-memory data. This allows it to detect deviations from authorized behavior without relying on an agent to report its own activity.

When Sentry detects a threat or policy violation, BlueField-4 can enforce policy in silicon and quarantine the agent within milliseconds. Together, the components provide an optional hardware safeguard alongside OpenShell’s software boundaries.

Scaling secure agent runtimes

Production agent deployments require infrastructure that can keep thousands of workflows running while governing every action. Vera supplies the compute capacity, memory bandwidth, and I/O needed to sustain those workflows. OpenShell provides the runtime boundaries that determine which actions may execute and which resources agents can access.

Together, Vera and OpenShell support agent execution within policies enforced outside the agent’s control. Agents can run for longer periods, use tools, and work with enterprise data while remaining subject to defined authorization boundaries. Where additional protection is required, NVIDIA Sentry on BlueField-4 adds independent monitoring and hardware-level enforcement.

The NVIDIA Vera Rubin platform, where large language models run, together with OpenShell and NVIDIA Sentry on BlueField-4, forms the OpenShell reference architecture. These components provide a hardware-rooted stack combining the performance required for agent workloads with controls intended to keep activity within authorized boundaries.