# NVIDIA OpenShell and Sentry: How the New Agent Security Architecture Works NVIDIA is separating agent execution from the systems that control it, but the software architecture and hardware protection have different availability timelines. By Paras Madan | 2026-10-21 NVIDIA announced its OpenShell Reference Architecture on October 21, 2026, bringing agent execution, access controls and optional hardware enforcement into one infrastructure design. The reference architecture is available now. NVIDIA Sentry, the BlueField-4 security framework described alongside it, is planned for early 2027. The important question for an enterprise agent is who can stop it when its next action exceeds its authority. A model instruction can describe the boundary, but the system still needs a separate mechanism that enforces it. ## What NVIDIA announced The [launch announcement](https://nvidianews.nvidia.com/news/openshell-reference-architecture) describes Vera Rubin infrastructure for model inference, Vera CPUs for agent harnesses and tool use, and BlueField-4 DPUs running Sentry for hardware-isolated monitoring and policy enforcement. OpenShell is the secure runtime software beneath that architecture. The distinction matters because adopting a software control pattern and procuring the full hardware configuration are different decisions. For a platform team, the architecture provides a way to ask more precise questions about an agent workload. Where does it execute code? Which component holds credentials? Which path carries its requests to external services? Which authority can revoke access? ## How OpenShell controls agent work [NVIDIA's technical breakdown](https://developer.nvidia.com/blog/how-nvidia-openshell-reference-architecture-secures-and-governs-ai-agent-workloads-at-scale/) identifies four components. The Gateway manages sandbox lifecycles and policies. The Supervisor checks outbound requests and mediates credential access from outside the sandbox. The Sandbox isolates the workload. The Policy Prover checks whether permissions remain within an organization-defined ceiling. Consider a coding agent that can read a repository and run tests. Its legitimate task might not require permission to publish a release or send files to arbitrary destinations. Those permissions should be expressed and checked outside the model's own reasoning. This also changes how teams should investigate a failed run. An agent saying that it followed policy is weak evidence. A separate record of which request was allowed, under which authority and with which credential is much more useful. ## What Sentry adds on BlueField-4 The [Sentry design](https://developer.nvidia.com/blog/inside-nvidia-sentry-secure-ai-agents-at-runtime) places selected controls in a hardware trust domain independent of the host. DOCA Tower, built on Envoy, inspects network requests and uses Open Policy Agent to evaluate policy. For connections configured for inspection, it terminates TLS to examine traffic. DOCA Argus contributes runtime context by inspecting selected host-memory regions. That lets access decisions consider the process or container behind a request rather than relying only on its network destination. NVIDIA describes millisecond-scale containment. This is a published capability claim, not a measured result for every customer deployment. Existing DOCA components can be explored now, while Sentry itself is planned for early 2027. Inspection also creates an operational responsibility. Teams need to decide who may access captured communications, what is retained and how those records are protected. Moving enforcement outside the workload does not remove the need to govern the enforcement system. ## Does OpenShell require Vera or BlueField-4? The [deployment documentation](https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/deployment-tiers.html) says no. OpenShell can be deployed independently of BlueField-4, and Vera is an agent-compute option rather than a mandatory CPU. A CPU virtual machine with routed model inference is a documented starting point for coding and lower-intensity workflows. GPU acceleration, local inference and DPU services are separate choices. That gives teams a practical evaluation path. They can first establish identity, permissions, credential handling and audit behavior on a modest deployment. A hardware decision can then follow the actual workload and threat model. The documentation also separates formal policy checking, runtime enforcement and retained evidence. Passing one of those checks does not establish the others. ## What the architecture does not replace NVIDIA's [scope guidance](https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/what-it-is-not.html) says the workspace is not an identity provider or a substitute for endpoint security, source-system authorization, code review or change management. It recommends VM-backed isolation for untrusted or model-generated code and assigns each workspace to one user. Before a wider rollout, a useful test is to run a normal workflow and deliberately deny one required action. The team should be able to explain the denial, revoke access, preserve the record and recover without silently broadening permissions. The architecture's value will depend on those ordinary operating details. Agent autonomy becomes easier to trust when authority can be inspected and withdrawn independently of the model doing the work. I'm Paras. I work at the intersection of AI, engineering and distribution. I help enterprise AI teams turn complex technical launches into clear stories that developers and decision-makers can understand. [Book a 30-minute call](https://cal.com/paras-madan/30min).