NVIDIA Open Agent Safety Platform OASP HardwareBased Agent Governance

NVIDIA unveiled the Open Agent Safety Platform (OASP) in September 2026, coupling the open‑source OpenShell runtime with the Sentry watchdog reference design that runs on BlueField‑4 DPUs. OpenShell provides kernel‑level isolation, sandboxed execution, and per‑outbound‑request policy checks, while Sentry monitors agent behavior out‑of‑band and can quarantine or halt malicious agents within milliseconds. The platform targets governance of agents on enterprise‑controlled infrastructure, aiming to move enforcement outside the model and into hardware. Analysts estimate it addresses less than 25% of enterprise agentic risk, leaving SaaS, third‑party, and attacker‑introduced agents ungoverned.

• Architecture & Core Components
• OpenShell provides kernel‑level isolation, sandboxed execution, and per‑outbound‑request policy validation.
• Sentry runs as an out‑of‑band watchdog on NVIDIA BlueField‑4 DPUs, creating an isolated trust domain.
• Policy prover and runtime governance components verify permissions and inspect each outbound request before it leaves the sandbox.
• BlueField‑4 DPU hosts Sentry, delivering deterministic, tamper‑resistant enforcement invisible to agents.

• NVIDIA Vera CPU supplies the underlying compute platform on which OpenShell executes agents.

• Deployment & Ecosystem

• Launched with a coalition of ~120 partners including Citi, JPMorganChase, Anthropic, Cisco, CrowdStrike, Dell, HPE, Hugging Face, Microsoft, Palantir, Palo Alto Networks, Red Hat, Salesforce, SAP, ServiceNow, and SpaceXAI.
• OpenShell’s permissive licensing permits extension to third‑party compute platforms (Arm, Intel, etc.) to reduce vendor lock‑in.
• Reference system design spans software, hardware, compute, and robotics layers for continuous in‑silicon agent monitoring.
• Integration with NVIDIA’s AI infrastructure stack enables side‑by‑side deployment with existing GPU‑accelerated workloads.

• Partner ecosystem supports joint validation, documentation, and reference implementations for heterogeneous environments.

• Performance & Enforcement Characteristics

• Sentry can detect anomalous agent behavior and quarantine or halt the agent within milliseconds.
• All outbound requests are checked by OpenShell policy enforcement before exiting the sandbox, preventing post‑facto remediation.
• Enforcement occurs in an isolated trust domain on the DPU, making it invisible and untamperable by agents or malware.
• Deterministic, hardware‑rooted policy enforcement reduces reliance on software‑only guardrails that can be bypassed.

• Platform provides continuous, real‑time visibility into agent activity without measurable impact on agent performance.

• Limitations & Critiques

• IDC’s Brent Ellis estimates OASP addresses less than 25% of enterprise agentic cybersecurity problems.
• Governance applies only to agents running on infrastructure the enterprise controls; SaaS, third‑party, and attacker‑introduced agents remain outside its scope.
• Effective deployment requires prior discovery and inventory of agents, adding operational overhead.
• Despite OpenShell being open‑source, NVIDIA’s dominant AI hardware share raises vendor lock‑in concerns for organizations on non‑NVIDIA compute.

• Analysts note the platform does not mitigate risks from unmanaged or external agent ecosystems.

• Strategic Implications & Outlook

• OASP marks a shift from pure software‑based AI guardrails to hardware‑enforced, silicon‑rooted governance.
• May serve as a reference architecture for future AI safety standards mandating out‑of‑band monitoring and policy enforcement.
• Encourages adoption of DPU and smartNIC‑based security controls across heterogeneous compute environments.
• Success could drive broader industry trust in hardware‑rooted attestation for autonomous agents and robotic systems.
• Future iterations may extend coverage to cross‑cloud and edge environments, addressing the current SaaS/third‑party gap.