Inside NVIDIA Sentry: Secure AI Agents at Runtime
- Source
- developer.nvidia.com
- Author
- Ofir Arkin
- Date
Context
NVIDIA Sentry is designed to watch and restrain AI agents from hardware the 's host cannot touch. It runs on a BlueField-4 DPU, which NVIDIA describes as a trust domain independent of the host, and in the OpenShell reference architecture that DPU sits on the node's only path to the model and to the outside world (NVIDIA's technical deep dive). From there, NVIDIA says, Sentry can inspect traffic and enforce policy without relying on the agent to report its own behavior, and keeps its monitoring and enforcement even if the host is compromised or the agent escapes its .
Sentry combines two views of an agent. The first is its network traffic. A per-agent firewall built with DOCA Flow blocks connections to unapproved destinations and passes permitted traffic to DOCA Tower, a transparent proxy built on the open-source Envoy proxy. For connections configured for inspection, Tower decrypts the traffic and evaluates each request with Open Policy Agent rules, and it is compatible with OpenShell policies. The second view comes from DOCA Argus, which reads selected regions of host memory from the DPU, with no software installed on the host, to map which containers, processes and libraries are running, identified by their hashes. Joining the two lets a policy ask who is really making a request. NVIDIA's example requires the container's hash to be on an approved list and the process that opened the connection to appear in the container's software bill of materials, the inventory of what it is supposed to contain, before checking whether the requested API action is allowed.
When something looks wrong, such as an unapproved tool running, excessive outbound traffic or large-scale file deletion, Sentry can request containment enforced in the DPU's silicon within milliseconds. It can also pass tool calls and available reasoning traces to separate classifier models, either inline, to block content before it arrives, or after the fact. Its records of agent activity are kept on BlueField-4, so an agent that edits logs inside its own environment cannot alter them. Sentry is not available yet; NVIDIA plans to release it early next year and points developers to existing DOCA libraries in the meantime. It complements the software controls in the OpenShell reference architecture published the same day.
- NVIDIA Sentry runs on BlueField-4 DPUs placed on the node's only path to the model, so it inspects and enforces agent traffic from a hardware trust domain the agent and host software cannot reach, and NVIDIA says it keeps working even if an agent escapes its sandbox.
- Traffic first meets a per-agent layer-4 firewall in silicon (DOCA Flow). Permitted connections go to DOCA Tower, an Envoy-based proxy that terminates TLS and checks requests against Open Policy Agent rules, which NVIDIA says evaluate in under a millisecond.
- DOCA Argus reads host memory from the DPU without a host agent and tracks containers, processes and libraries by hash. Policies can then require, for example, an approved container hash and a calling process listed in the container's SBOM before allowing a request.
- Warning signs Sentry watches include unapproved tools, ptrace against other processes, excessive outbound traffic, unauthorized file changes and mass deletion. On a deviation it can request in-silicon containment within milliseconds without the agent's or host's cooperation.
- Activity records and policy decisions are kept on BlueField-4, so an agent that edits logs in its own environment cannot alter the protected copy. Sentry is not available yet: NVIDIA plans availability early next year, with DOCA libraries as the current starting point.
Checking sign-in…
Loading comments…