NVIDIA OpenShell Reference Architecture Puts Agent Security in Infrastructure

Governance outside the agent's reach

According to NVIDIA, autonomous agents can work for hours on complex tasks, accessing files, tools and the internet, and spawning other agents. Over long time horizons this leads to compounding risk: agents may download code, build new tools, request additional privileges and touch more of the underlying infrastructure. NVIDIA argues that "an agent cannot govern itself", and that security and governance belong in the infrastructure the agent operates in.

OpenShell is NVIDIA's open-source runtime for building that control into the infrastructure. It defines and enforces which systems and data an agent can access, from files and internet services to systems that interact with physical devices. The runtime treats agent workloads as untrusted throughout execution and gives an agent access to what it needs, when it needs it.

OpenShell has four components:

• Gateway: the control plane that manages sandbox lifecycles and policies.
• Supervisor: checks outbound requests against policy and mediates access to credentials, running completely separate to the sandbox.
• Sandbox: isolates the agent workload and restricts filesystem and process access.
• Policy prover: adds formal verification, checking whether a policy's permissions stay within an organization-defined ceiling.

NVIDIA also stresses extensibility. Supervisor middleware lets users inspect, block or change content an agent sends and receives over the network. Gateway interceptors let operators add deployment-specific governance to control-plane operations without modifying the gateway. OpenShell also provides enforcement points where identity, authorization, data protection and auditing systems can be integrated.

Vera CPUs as the compute layer

In the reference architecture, OpenShell runs on NVIDIA Vera CPUs. NVIDIA frames the split simply: OpenShell defines what agents can do, and Vera determines how fast they can do it. Agents work in loops of dependent steps, such as reasoning, calling tools, executing code and querying data, and AI factories run thousands of these loops at once.

NVIDIA says Vera has 88 NVIDIA-designed Olympus cores and claims up to 2x performance on critical agentic workloads versus x86. It cites a second-generation Scalable Coherency Fabric with up to 3x core-to-core bandwidth and up to 50% lower core-to-core latency than x86 alternatives, plus 96 lanes of PCIe Gen 6. Memory is LPDDR5X with up to 1.2 TB/s of bandwidth and up to 40% lower loaded memory latency than chiplet-based designs. The company also claims 2x more performance per watt than x86 CPUs.

CoreWeave, the AI cloud platform, reported sandbox startup more than 3x faster on Vera than on x86, with a single rack supporting more than 11,000 concurrent agent environments. Running Terminal Bench, which measures CPU performance across real agentic loop tasks, CoreWeave found Vera 1.8x faster than x86 across tasks ranging from scripting to database recovery. NVIDIA's figure describes a comparison against a leading x86 CPU across 20 real-world agent tasks.

BlueField-4 and Sentry add hardware enforcement

For deployments needing more protection, NVIDIA extends the separation into silicon. NVIDIA BlueField-4 DPUs provide a hardware-isolated trust domain outside the agent's reach, sitting in the I/O path between agents running on Vera and the models they access.

NVIDIA Sentry, a security software framework built on NVIDIA DOCA, runs in that independent domain. It monitors requests and responses, networking and file activity, verifies identity and delegated authority, and analyzes selected host memory to detect deviations from authorized behavior without relying on agent self-reporting. When it finds a threat or policy violation, BlueField-4 enforces policy in silicon, allowing Sentry to quarantine the agent within milliseconds, according to NVIDIA.

What it means for teams deploying agents

The architecture gives organizations a model in which agent controls sit outside the agent and can be audited, extended and, where needed, backed by hardware. NVIDIA points readers to the OpenShell GitHub repository to start implementing agent governance, and to the Secure Agent Workspace Reference Design documentation for deployment guidance. The performance figures come from NVIDIA and from CoreWeave's measurements as reported by NVIDIA.