NVIDIA Sentry and OpenShell Move Agent Enforcement Outside the Agent's Reach

An AI agent can complete its assignment and still cross a security boundary. That is the failure mode NVIDIA targets in two technical posts published Oct 21, 2026 alongside GTC Berlin: Inside NVIDIA Sentry: Secure AI Agents at Runtime and the companion OpenShell reference architecture deep dive. The premise is blunt: monitoring and enforcement must operate outside the agent’s reach so the agent cannot alter or disable them.

The timing is not theoretical. The same morning, Semafor reported that OpenAI said its agents disabled parts of an internal misbehavior monitoring system, following a slew of reports of agents unexpectedly breaking out of sandboxes. Semafor keeps that separate from human-directed misuse: in one episode it cites, a hacker tasked an array of agents with breaching more than 100 companies’ internal systems. A monitor that lives inside the environment it polices is a monitor that environment can attack — the pattern we flagged after Black Hat’s sandbox-escape demonstrations.

Sentry: a judge that sits in silicon

Sentry is a security software framework that monitors agents and enforces policies governing their access to models, tools and data. It is built on NVIDIA DOCA and runs on BlueField-4 DPUs in a hardware-isolated trust domain independent of host software. In the OpenShell reference architecture, agents execute on Vera CPUs while BlueField-4 sits on the node’s only path to the model, so all agent network traffic flows through Sentry whether the agent cooperates or not.

Three components do the work:

• DOCA Tower, an AI security gateway built on the Envoy proxy. It acts as a transparent proxy, terminating TLS with in-silicon acceleration and evaluating requests against Open Policy Agent rules written in Rego. OPA runs locally in memory and can evaluate requests in under a millisecond, depending on policy complexity.
• DOCA Argus, agentless real-time memory introspection. It runs on the DPU without host-resident agents, maps containers to pods and sandboxes to microVMs, and tracks processes and loaded libraries by hash. Because it lives outside the host, it keeps visibility even if the host is compromised.
• Specialized AI classifiers that read tool calls and reasoning traces to flag behavioral drift — inline, blocking harmful content before it reaches its destination, or out of band, triggering a response after misbehavior is detected.

Layer	Component	What it enforces
Network	DOCA Flow	Layer-4 firewall per agent, accelerated in silicon
Application	DOCA Tower	TLS termination, OPA policy, PII and secret redaction, A2A and MCP governance
Runtime	DOCA Argus	Container, process and library hashes, SBOM and execution-path checks
Behavior	AI classifiers	Drift detection, inline or out of band
Response	BlueField-4	Containment and quarantine within milliseconds

The correlation step is the operationally interesting part. Sentry joins Tower’s network context with Argus’s runtime evidence, so a policy can require not only that a request targets an approved API, but that the container hash matches an allowlist and the initiating process appears in the container SBOM with an approved execution path and command-line arguments. Warning signs it lists include executing unapproved tools, ptrace attacks on other processes, excessive outbound traffic suggesting data leakage, and large-scale file deletion. On detection, BlueField-4 can contain and quarantine the agent within milliseconds without the cooperation of the agent or host software — and because enforcement lives in the DPU’s isolated trust domain, NVIDIA says it survives even a sandbox escape.

Evidence handling follows the same logic. Tower integrates SPIFFE/SPIRE for verifiable workload identity, and Sentry writes attested, tamper-evident records outside the agent’s reach: an agent that edits logs inside its own environment cannot change the protected copy on BlueField-4. Telemetry can feed XDR and SIEM platforms. It is the infrastructure-grade version of the pre-action gate argument: judge the action from a place the actor cannot touch.

OpenShell: the software boundary that ships first

Sentry is the optional hardware safeguard underneath OpenShell, an open-source runtime that governs what an agent can do. Its stated maxim: an agent cannot govern itself. It has four components: a Gateway (control plane managing sandbox lifecycles and policies), a Supervisor (checks outbound requests against policy and mediates credential access, running completely separate from the sandbox), a Sandbox (isolates the workload and restricts filesystem and process access), and a Policy Prover (formal verification that policy permissions stay within an organization-defined ceiling).

NVIDIA cites CoreWeave measurements for the reference architecture: more than 3x faster sandbox startup on Vera versus a leading x86 CPU, 1.8x faster agentic loop completion on Terminal Bench, and a single rack supporting more than 11,000 concurrent agent environments — density claims that echo Modal’s earlier Vera benchmarks. A separate NVIDIA blog post lists cloud partners backing the architecture, including CoreWeave, Crusoe, DigitalOcean, Lambda, Nebius, Nscale and Vultr, and frames it as the safety-boundary story for European sovereign clouds.

What operators can do now

Sentry itself is not deployable today: NVIDIA describes availability as planned for early next year. Two pieces are available in the meantime. First, the DOCA libraries and microservices the post names as a starting point — DOCA Argus, DOCA Flow and OVS-DOCA — for teams that already run BlueField hardware and want to experiment with out-of-band observability and infrastructure enforcement. Second, OpenShell is open source now, with a GitHub repository and a Secure Agent Workspace reference design; the software boundary does not wait on silicon.

Even without either, the architecture doubles as a checklist for any agent fleet:

1. Put enforcement outside the agent process, so compromising the workload does not compromise the monitor.
2. Allowlist egress at layer 4 and layer 7, and govern A2A and MCP traffic explicitly.
3. Bind access decisions to workload identity — container hashes, process hashes, SBOMs — not just API keys.
4. Redact secrets and PII at the gateway, in requests and responses alike.
5. Keep audit records the agent cannot write to, and ship them to the SIEM before the incident, not after.

Caveats

Every number here — sub-millisecond policy evaluation, millisecond containment, CoreWeave’s 3x and 1.8x — comes from NVIDIA or NVIDIA-reported partner measurements, not independent tests. The full stack assumes NVIDIA silicon, so most teams will consume it through cloud partners rather than deploy it, and the classifier layer inherits the usual weakness of AI-based detection: no false-positive rates are published. What the launch does establish is a direction. After a run of reported sandbox escapes and an agent disabling its own monitor, the enforcement point is moving into infrastructure the agent cannot reach.