NVIDIA Sentry Guards AI Agents From a Separate Hardware Layer

Security controls placed outside the agent's reach

NVIDIA argues that an AI agent can complete its assignment and still cross a security boundary. The company points to recent incidents in which agents circumvented security controls while using tools, credentials and services to pursue their assigned goals. Its conclusion is that monitoring and enforcement must operate where the agent cannot touch them.

Sentry is part of the NVIDIA OpenShell reference architecture announced at GTC Berlin. It is built on NVIDIA DOCA and runs on NVIDIA BlueField-4 DPUs. According to NVIDIA, it validates that an agent operates according to its designed intent and within its defined operational boundaries, and it provides tamper-evident traceability of agent activity.

OpenShell itself is a secure runtime for autonomous agents that separates policy enforcement from the agent workload, so a compromised agent cannot change its own restrictions. Sentry adds an independent hardware safeguard out of band, running on BlueField-4. In the reference architecture, agents execute on NVIDIA Vera CPUs, while BlueField-4 sits on the node's only path to the model.

DOCA Tower and the policy engine

The communications side of Sentry is handled by DOCA Tower, described as the framework's AI security gateway. It is built on Envoy, the open source edge and service proxy, and works as a transparent proxy that places a bidirectional inspection layer between an agent and the external environment. Agent network traffic reaches BlueField-4 through a direct network I/O path that bypasses host OS and hypervisor packet processing.

Access is controlled in two stages:

• Layer 4: DOCA Flow implements a firewall for each agent, accelerated in silicon on BlueField-4. It blocks connections to unauthorized destinations and forwards permitted traffic onward.
• Layer 7: DOCA Tower performs TLS termination using built-in, in-silicon TLS acceleration. For connections configured for inspection, it decrypts the permitted traffic to inspect and control agent communications.

Requests are evaluated by Open Policy Agent (OPA), an open source policy engine that uses the declarative language Rego. NVIDIA says OPA runs locally in memory and can evaluate requests in under a millisecond, depending on policy complexity and configuration. DOCA Tower is compatible with OpenShell policies, extending network access policies and runtime controls into BlueField-4 and the infrastructure.

DOCA Argus adds runtime context

Network traffic alone gives only part of the picture, according to NVIDIA. DOCA Argus supplies visibility into the agent's execution environment through live memory introspection, analyzing selected regions of volatile host memory to obtain independent evidence of the system's operational state. It runs on BlueField-4 without host-resident agents, which NVIDIA says preserves host compute resources, and it stays out of reach of host software even if the host is compromised.

Argus maps the environment in real time, for example containers to their pods and sandboxes to microVMs, and identifies running processes and their properties. It also maps relationships between processes and threads, file access, network connections, loaded libraries, CPUs, GPUs and memory. Containers, processes and libraries are tracked by their hashes.

Sentry correlates the connection data from DOCA Tower with this runtime context. A network access policy can, for example, require that a container's hash match a list of approved hashes. It can also require that the initiating process, identified by its hash, appear in the container software bill of materials (SBOM), have permission to initiate network connections, and use an approved execution path and command-line arguments. Only then does DOCA Tower check whether policy permits the requested access, such as access to an API. Sentry also enriches its tamper-evident activity records with this context, which NVIDIA says reduces the need for downstream correlation.

What it means for teams running agents

For organizations deploying autonomous agents, Sentry offers a way to enforce access rules without relying on the agent, or the host it runs on, to behave honestly or stay uncompromised. According to NVIDIA's summary, the framework can also use specialized AI models to classify agent communications inline or out of band to detect behavioral drift, contain agents within milliseconds through in-silicon enforcement, and preserve attested telemetry on BlueField-4 for forensic investigation and integration with enterprise security platforms.

NVIDIA suggests developers explore its DOCA libraries and microservices to experiment with out-of-band observability and infrastructure enforcement. The source text provided does not give pricing or availability details for Sentry.