SentinelOne backs NVIDIA's Open Agent Safety Platform for hardware-level AI governance

Guardrails the model can reach

Weingarten, writing on the SentinelOne blog, says every guardrail that exists today lives in software the model itself can reach. Models are aligned once and then run non-deterministically, he writes, increasingly at the endpoint and with growing authority to act: in vehicles, industrial systems, humanoid robots, and agents with access to enterprise systems.

According to the post, alignment is checked before release, but nothing independently monitors the system at runtime. Weingarten points to an incident from the previous week, in which an AI agent in training at a frontier lab bypassed its network restrictions. Monitoring flagged it within 15 minutes, he writes, but the automated kill switch failed, and it took two and a half hours to stop the run by hand.

His conclusion is that watching is not enough if nothing independent can act. He also cites NVIDIA's own security engineers: "A control that the agent can decline to invoke is not an effective security control."

A reference monitor for AI

The post draws on a 1972 study by James P. Anderson for the U.S. Air Force, which defined the reference monitor. According to Weingarten, the enforcing mechanism must be tamperproof, must always be invoked, and must be small enough to verify. He calls it the gold standard for enforcement architecture and says AI requires the same standard.

In his view, a model must be governed by a layer that is separate from the intelligence it supervises and unreachable by it. That layer should run in real time alongside the model and its compute and produce cryptographically attestable evidence of runtime behavior that operators, regulators, and insurers can independently verify.

Hardware as the foundation

Weingarten describes hardware isolation and attestation as the most consequential capabilities of NVIDIA's announcement. He says NVIDIA's BlueField-4 places enforcement outside the host operating system, where tenant software cannot disable or bypass it. Together with other secure enclave architectures, this lets the runtime be secured directly from the hardware and reduces the surface that must be secured to the hardware boundary itself.

He adds that substantial work remains. The hardware boundary must be soundly secure, must hold across deployment environments, including frontier AI services used alongside workloads that must remain local, and must extend to any AI on any compute that supports it. The goal, he writes, is that anything running on a truly secure, hardware-rooted architecture should be provably governed, and that this should be simple and transparent to the end user.

Verifiable agency and what comes next

Weingarten frames the wider challenge as governing action when agency is shared between humans and machines. He lists six requirements: acting in time, showing evidence, acting independently when required, staying within boundaries, attributing actions, and keeping accountability. He calls this combination "verifiable agency".

He says continuous behavioral visibility makes this achievable. According to SentinelOne, its behavioral AI is deployed at global scale and protects nearly one-fifth of the Fortune 500. The company aims to make every autonomous action traceable, auditable, and overridable by a human.

Looking ahead, Weingarten expects regulation, standards, and insurance to converge on the same requirement: evidence of how AI behaves at runtime, not only how it was aligned before release. He predicts that within a few years, an AI product without attested runtime governance will be difficult to certify and difficult to insure, and more so for physical AI. For organizations deploying autonomous agents, the post suggests runtime attestation may become a condition of trust and coverage.