How NVIDIA OpenShell Reference Architecture Secures and Governs AI Agent Workloads at Scale

NVIDIA's OpenShell reference architecture packages its agent runtime into a full stack: OpenShell software decides what an agent may reach, Vera CPUs run the agents, and an optional hardware layer, Sentry on BlueField-4 DPUs, monitors them from outside the host (NVIDIA's overview). The premise is that an agent cannot govern itself, so security and governance controls have to sit in the infrastructure around it.

OpenShell, covered earlier in a runtime walkthrough, treats agent workloads as untrusted throughout execution. Its gateway is the control plane that manages sandboxes and their policies. A supervisor running separately from the sandbox checks outbound requests against policy and mediates access to credentials, while the sandbox restricts filesystem and process access. A policy prover formally checks whether a policy's permissions stay within a ceiling the organization defines. The post emphasizes two extension points: supervisor middleware can inspect, block or change what an agent sends and receives over the network, and gateway interceptors let operators add their own governance to control-plane operations without modifying the gateway. Identity, authorization, data protection and auditing are not presented as built in; OpenShell provides enforcement points where those systems can be integrated.

Much of the post argues for Vera as the hardware underneath. NVIDIA claims up to 2x performance on critical agentic workloads versus x86. It also cites CoreWeave, which found sandbox startup more than 3x faster on Vera than on x86, more than 11,000 concurrent agent environments in a single rack, and 1.8x faster performance on Terminal Bench tasks. The post does not name the x86 processors or test configurations behind these comparisons. Sentry is the optional layer for deployments that need more protection: BlueField-4 sits in the path between agents and the models they call, and NVIDIA says Sentry can quarantine an agent within milliseconds when it detects a policy violation. The Sentry deep dive explains how that monitoring works.