Inside NVIDIA Sentry: Runtime Security for AI Agents

AI agents can complete assigned tasks while still crossing security boundaries. Recent incidents have shown that agents may bypass controls while using tools, credentials, and services. For that reason, monitoring and enforcement should operate outside the agent’s reach, preventing the agent from modifying or disabling those protections.

NVIDIA Sentry is a security software framework that monitors AI agents and enforces policies for access to models, tools, and data. It is part of the NVIDIA OpenShell reference architecture announced at GTC Berlin. Built on NVIDIA DOCA and designed to run on NVIDIA BlueField-4 DPUs, NVIDIA Sentry provides host-isolated runtime protection for AI agents.

The framework validates whether an agent is operating according to its intended design and within defined operational boundaries. It controls the agent’s only path to the model, creates tamper-evident records of activity, and applies granular access controls in silicon. Alongside communication inspection, NVIDIA Sentry uses out-of-band observability to maintain real-time awareness of agent behavior, security, and integrity.

An independent security layer for agent runtime protection

An earlier discussion of agentic AI security described how NVIDIA BlueField runs security services in a hardware trust domain separate from the host.

NVIDIA Sentry builds on this model by continuously monitoring agent behavior and enforcing access policies independently of host software. Its security boundary operates in a separate hardware trust domain outside the agent’s reach, helping keep the agent within its intended scope.

Software runtime boundaries remain important. NVIDIA OpenShell provides a secure runtime for autonomous agents and governs what they can do. OpenShell separates policy enforcement from the agent workload, preventing a compromised agent from changing its own restrictions. NVIDIA Sentry adds an independent hardware safeguard on BlueField-4 that operates out of band and remains beyond the agent’s reach and knowledge.

In the OpenShell reference architecture, agents run on NVIDIA Vera CPUs, while BlueField-4 is positioned on the node’s only path to the model. NVIDIA Sentry inspects agent-to-model communications and enforces access policies without relying on the agent to report its own behavior. Memory introspection supplies additional information about the execution environment, such as a container or microVM, helping identify external threats and agent misbehavior.

Governing agent communications

DOCA Tower serves as NVIDIA Sentry’s AI security gateway. Built on Envoy, the open source edge and service proxy, it works as a transparent proxy for agent traffic and provides bidirectional inspection between the agent and the external environment.

Agent network traffic reaches BlueField-4 through a direct network I/O path that bypasses packet processing by the host operating system and hypervisor. Because BlueField-4 sits on the only path to the model and the outside world, NVIDIA Sentry governs the agent’s network communications.

DOCA Flow and DOCA Tower work together to restrict access to approved resources:

• DOCA Flow implements a layer-4 firewall for each agent, accelerated in BlueField-4 silicon.
• The firewall blocks connections to unauthorized destinations.
• Permitted traffic is forwarded to DOCA Tower for layer-7 inspection, authorization, and further security checks.

DOCA Tower operates as a transparent proxy and performs Transport Layer Security (TLS) termination using built-in, in-silicon TLS acceleration. For connections configured for inspection, it decrypts traffic allowed by the layer-4 firewall so the agent’s communications can be inspected and controlled.

NVIDIA Sentry uses the Open Policy Agent (OPA) to evaluate access requests against defined policies. OPA uses Rego, a declarative domain-specific language for evaluating complex hierarchical data structures. OPA runs locally in memory and can evaluate requests in under a millisecond, depending on policy complexity and configuration.

DOCA Tower is compatible with OpenShell policies. OPA extends those network access policies and runtime controls into BlueField-4 and the surrounding infrastructure.

Figure 1. NVIDIA Sentry uses DOCA Tower to inspect access requests and a policy engine to evaluate authorization, with runtime context from DOCA Argus.

Enforcing access policies with runtime context

Network communications provide only part of the information needed to assess an agent’s security and integrity. Visibility into the execution environment adds context for access decisions beyond a traditional resource policy.

DOCA Argus provides real-time visibility into an agent’s execution environment and operational state, giving NVIDIA Sentry additional information about access requests. It uses live memory introspection to analyze selected regions of volatile host memory and obtain independent evidence about the system’s operational state.

DOCA Argus runs independently of the host and analyzes host memory on BlueField-4 without host-resident agents. This agentless design provides independent runtime visibility while preserving host compute resources. Because it operates outside the host in its own isolated trust domain, DOCA Argus remains beyond the reach of host software, including when the host is compromised.

DOCA Argus maps the execution environment in real time. For example, it can associate containers with their pods and sandboxes with their microVMs. It identifies running processes and their properties within each environment, and maps relationships among processes and threads, file access, network connections, loaded libraries, CPUs, GPUs, memory, and other system resources. It tracks containers, processes, and loaded libraries through their associated hashes.

This runtime context allows NVIDIA Sentry to connect access requests with the processes and execution environments behind them. Policies can therefore consider both the requested action and the security and integrity of the agent making the request.

Using runtime context to evaluate access

NVIDIA Sentry correlates network connection information from DOCA Tower with runtime context from DOCA Argus when evaluating access requests. It uses this information to apply policies based on additional attributes and assertions supplied by DOCA Argus. Runtime context also enriches tamper-evident activity records, reducing the need for downstream correlation.

DOCA Tower can correlate a network connection with the process that initiated it, the process’s properties, and its container. A network access policy might require the container’s hash to match an approved list. It might also require that:

• The initiating process hash appears in the container software bill of materials (SBOM).
• The process has permission to initiate network connections.
• The process uses an approved execution path and approved command-line arguments.
• The requested API access and operation are permitted by policy.

NVIDIA Sentry uses DOCA Argus observations and alerts to evaluate agent security continuously. Potential warning signs include:

• Executing unapproved tools
• Using ptrace to attack another process or spawn a process that attacks the agent
• Excessive outbound traffic that may indicate data leakage
• Unauthorized file access or modification
• CPU spikes
• Excessive writes to temporary folders
• Large-scale file deletion

When NVIDIA Sentry detects a deviation, it can request containment on a millisecond scale using in-silicon enforcement.

Extending controls to agent interactions

Agent security policies need to govern both information leaving the sandbox and content entering it. Requests may expose sensitive information or initiate unauthorized operations. Responses may contain malicious instructions or other content that redirects an agent from its assigned goals.

NVIDIA Sentry uses DOCA Tower’s extensible inspection capabilities to apply controls to requests and responses. These controls can:

• Apply IP-, URL-, and protocol-level restrictions to agent communications.
• Capture tamper-evident records of requests, responses, and data flows for behavioral analysis and investigation.
• Govern agent-to-agent (A2A) and Model Context Protocol (MCP) traffic.
• Detect and redact personally identifiable information and secrets, including API keys, tokens, and passwords.
• Identify and block content prohibited by policy.

NVIDIA Sentry evaluates inspected requests and responses throughout an agent session as the agent accesses models, tools, APIs, and services.

Evaluating agent behavior with specialized models

NVIDIA Sentry integrates with specialized AI models that analyze agent communications and classify behavior using tool calls and available reasoning traces. These models can run locally or remotely on dedicated GPU-accelerated systems. Their classifiers assess whether an agent’s actions remain consistent with its designed intent or indicate behavioral drift.

The models can classify communications inline or out of band. Inline classification can block potentially harmful content before it reaches its destination. Out-of-band classification can trigger a response after detecting misbehavior.

Tamper-evident activity records and detection results provide forensic evidence for later incident investigations. Continuous classification is required to detect communication-based misbehavior, while DOCA Argus complements it by analyzing the agent’s operational environment and runtime behavior.

Figure 2. NVIDIA Sentry uses DOCA Tower to submit inspected communications to a specialized model for classification, allowing potentially harmful content to be blocked inline.

NVIDIA Sentry can contain and quarantine agents within milliseconds using BlueField-4 in-silicon enforcement, without cooperation from the agent or host software.

These independent controls remain available when software boundaries fail. Even if an agent escapes its sandbox, NVIDIA Sentry continues monitoring and enforcement from BlueField-4’s isolated trust domain.

Enterprise security platforms can use NVIDIA Sentry telemetry to correlate detections and request response actions. The protected record preserves the observed activity and policy context that led to enforcement.

Figure 3. NVIDIA Sentry combines interaction telemetry, runtime detections, and policy context with enterprise security integrations to drive response actions through DOCA Tower.

Using agent identity in access decisions

Security controls must connect an agent’s identity with its permissions and requested actions. NVIDIA Sentry uses this identity context during application-layer policy evaluation. DOCA Tower integrates with SPIFFE/SPIRE to support verifiable workload identity and can also integrate with partner identity systems.

Identity establishes who is making a request. Authorization policies determine which resources that identity may access and which operations it may perform. Runtime evidence adds information about the execution environment associated with the request.

This approach connects identity with runtime security. If an agent’s behavior or integrity changes, NVIDIA Sentry can use that context when evaluating later access requests and apply the organization’s defined policies.

Preserving a trusted record of agent activity

Security teams need evidence for incident investigations, including cases where an agent escapes its sandbox or alters host-based logs.

NVIDIA Sentry produces attested telemetry and tamper-evident records through BlueField-4’s independent trust domain. DOCA Tower records inspected communications and policy decisions outside the reach of the agent and host software, while DOCA Argus contributes independently observed runtime signals.

An agent that changes a log inside its own environment cannot make the same change to the protected record maintained on BlueField-4.

Attestation provides verifiable evidence of the telemetry’s source and integrity. Security teams can use these records to reconstruct observed interactions, review enforcement decisions, and support audits.

NVIDIA Sentry can provide telemetry to enterprise security platforms, including XDR and SIEM platforms and security data lakes. These integrations connect agent activity with broader threat intelligence, detection logic, and incident-response workflows.

Extending NVIDIA Sentry with enterprise security capabilities

NVIDIA Sentry allows developers and cybersecurity providers to extend monitoring, governance, and enforcement through DOCA libraries and microservices.

DOCA Tower uses Envoy’s extensibility, allowing partners to adapt existing plugins or develop new ones that run on BlueField. This provides a foundation for integrating access controls, content inspection, telemetry, and specialized detection logic into the application-layer path.

NVIDIA plans to publish core plugins, including one that exposes agent communications for further analysis of available reasoning traces.

Partners can combine these capabilities with identity services, AI classifiers, threat intelligence, and security operations platforms. NVIDIA Sentry provides independent runtime visibility and infrastructure enforcement, while connected platforms add enterprise context and coordinate investigation and response.

Building layered protection for AI agents

Scaling agentic AI requires continuous visibility into what agents can access and do during execution. NVIDIA Sentry places that visibility and control in an independent infrastructure domain, combining application-layer inspection through DOCA Tower with runtime evidence from DOCA Argus and in-silicon enforcement on BlueField-4.

Together with NVIDIA OpenShell, NVIDIA Sentry extends protection from software execution boundaries to a hardware-isolated safeguard. It enables security teams to evaluate agent identity, authority, interactions, and runtime integrity together, then act when behavior crosses defined boundaries.

NVIDIA DOCA provides the foundation for exploring these capabilities. Available libraries and microservices, including DOCA Argus, DOCA Flow, and OVS-DOCA, support experimentation with out-of-band observability and infrastructure enforcement ahead of NVIDIA Sentry’s planned availability early next year.