{"slug": "inside-nvidia-sentry-secure-ai-agents-at-runtime", "title": "Inside NVIDIA Sentry: Secure AI Agents at Runtime", "summary": "NVIDIA introduced Sentry, a security software framework that monitors AI agents and enforces policies on their access to models, tools and data, running on NVIDIA BlueField-4 DPUs and built on NVIDIA DOCA. Sentry is part of the NVIDIA OpenShell reference architecture announced at GTC Berlin, and it places a bidirectional inspection layer between an agent and the outside world so enforcement sits in a hardware trust domain outside the agent's reach. The framework is designed to validate that an agent operates within its designed intent and defined operational boundaries, providing tamper-evident traceability of agent activity even when host resources cannot be trusted.", "body_md": "An AI agent can complete its assignment and still cross a security boundary. Recent incidents show that agents can circumvent security controls while using tools, credentials, and services to pursue their assigned goals. Monitoring and enforcement need to operate outside the agent’s reach so that it can’t alter or disable them.\n\n[NVIDIA Sentry](https://www.nvidia.com/en-us/networking/products/software/sentry/) is a security software framework that monitors AI agents and enforces policies governing their access to models, tools, and data. Part of the [NVIDIA OpenShell reference architecture](https://nvidianews.nvidia.com/news/openshell-reference-architecture) announced at GTC Berlin, it’s built on [NVIDIA DOCA](https://www.nvidia.com/en-us/networking/products/software/doca/), runs on [NVIDIA BlueField-4 DPUs](https://www.nvidia.com/en-us/networking/products/data-processing-unit/), and provides host-isolated runtime protection for AI agents. NVIDIA Sentry validates that an agent operates according to its designed intent and within its defined operational boundaries.\n\nTrusted even when host resources can’t be trusted, it controls the agent’s only path to the model, providing tamper-evident traceability of agent activity while enforcing granular security controls on agent access in silicon. In addition to inspecting agent communications, NVIDIA Sentry uses out-of-band observability to establish real-time situational awareness, continuously evaluating agents’ runtime security and behavior to validate their security and integrity.\n\nThis post explains how NVIDIA Sentry evaluates agent requests, detects threats, and enforces security policies independently of host software.\n\n## An independent security layer for agent runtime protection\n\nAn earlier [agentic AI security](https://developer.nvidia.com/blog/advancing-ai-infrastructure-for-agentic-ai-with-nvidia-doca-in-silicon-security) post described how NVIDIA BlueField runs security services in a hardware trust domain independent from the host.\n\nNVIDIA Sentry builds on that foundation to continuously monitor AI agent behavior and enforce access policies independently of host software, establishing a strict security boundary in a separate hardware trust domain outside the agent’s reach to keep agents operating within their designed intent.\n\nSoftware runtime boundaries remain essential. [NVIDIA OpenShell](https://developer.nvidia.com/blog/how-nvidia-openshell-reference-architecture-secures-and-governs-ai-agent-workloads-at-scale/) is a secure runtime for autonomous agents that governs what an agent can do. OpenShell separates policy enforcement from the agent workload, so a compromised agent can’t change its own restrictions. NVIDIA Sentry adds an independent hardware safeguard out of band, running on BlueField-4, beyond the agent’s reach and knowledge.\n\nIn the OpenShell reference architecture, agents execute on [NVIDIA Vera CPUs](https://www.nvidia.com/en-us/data-center/vera-cpu/), while BlueField-4 sits on the node’s only path to the model. NVIDIA Sentry inspects agent-to-model communications and enforces access policies without relying on the agent to report its own behavior. Memory introspection adds context about the agent’s execution environment, such as a container or microVM, to help detect external threats and agent misbehavior.\n\n## Governing agent communications\n\nDOCA Tower is NVIDIA Sentry’s AI security gateway. Built on [Envoy](https://www.envoyproxy.io), the open source edge and service proxy, it operates as a transparent proxy for agent traffic, placing a bidirectional inspection layer between an agent and the external environment.\n\nAgent network traffic reaches BlueField-4 through a direct network I/O path that bypasses host OS/hypervisor packet processing. All of the agent’s network communications are governed by NVIDIA Sentry as BlueField-4 sits on the only path to the model and to the outside world.\n\nAn agent’s network access boundary is controlled using DOCA Flow and DOCA Tower, which work in concert to restrict agent access to approved resources. DOCA Flow is used to implement a layer-4 firewall for each agent, accelerated in silicon on BlueField-4. The firewall blocks connections to unauthorized destinations and forwards permitted traffic to DOCA Tower for layer-7 (application layer) inspection, authorization, and additional security checks.\n\nDOCA Tower acts as a transparent proxy, performing Transport Layer Security (TLS) termination using built-in, in-silicon TLS acceleration. For connections configured for inspection, it decrypts the agent traffic permitted by the layer-4 firewall to inspect and control agent communications.\n\nNVIDIA Sentry uses the [Open Policy Agent](https://www.openpolicyagent.org/docs/) (OPA), an open source policy engine, to evaluate access requests against defined policies. OPA uses Rego, a declarative domain-specific language designed to evaluate complex hierarchical data structures. OPA runs locally in memory and can evaluate requests in under a millisecond, depending on policy complexity and configuration.\n\nDOCA Tower is compatible with OpenShell policies, using OPA to extend network access policies and runtime controls into BlueField-4 and to the infrastructure.\n\n## Enforcing agent access policies with runtime context\n\nAn agent’s network communications provide only part of the information needed to assess its security and integrity. Visibility into the agent’s execution environment adds context for evaluating access requests that go beyond a traditional resource access policy.\n\nDOCA Argus provides real-time visibility into an agent’s execution environment and operational state, giving NVIDIA Sentry additional context about agent access requests.\n\nIt uses live memory introspection to analyze selected regions of volatile host memory and obtain independent evidence of the system’s operational state.\n\nDOCA Argus runs independently of the host, analyzing host memory on BlueField-4 without host-resident agents. This agentless design provides independent runtime visibility while preserving host compute resources. By operating outside the host in its own isolated trust domain, DOCA Argus remains beyond the reach of host software even if the host is compromised.\n\nDOCA Argus maps the execution environment in real time—for example, containers to their respective pods and sandboxes to microVMs—and identifies the running processes and their properties within each environment. It also maps relationships between processes and threads, file access, network connections, loaded libraries, CPUs, GPUs, memory, and other system resources. DOCA Argus tracks containers, processes, and loaded libraries using their associated hashes.\n\nThis runtime context enables NVIDIA Sentry to connect agent access requests to the processes and execution environments behind them, enforcing policies that consider both the requested action and the security and integrity of the agent making it.\n\n### Using runtime context to evaluate agent access\n\nNVIDIA Sentry correlates network connection information from DOCA Tower with runtime context from DOCA Argus to evaluate access requests. NVIDIA Sentry uses this context to enforce policies based on additional attributes and assertions provided by DOCA Argus. It also enriches tamper-evident records of agent activity with runtime context, reducing the need for downstream correlation.\n\nFigure 1 shows how these checks work. DOCA Tower uses its policy engine to correlate a network connection with the agent’s process that initiated it, its properties, and the container it belongs to. A network access policy can, for example, require that the container’s hash match a list of approved container hashes. It can also require that the initiating process, identified by its hash, appear in the container software bill of materials (SBOM), have permission to initiate network connections, and use an approved execution path and command-line arguments. DOCA Tower then checks whether policy permits the requested access—for example, access to an API and permission to perform the requested action.\n\nNVIDIA Sentry uses DOCA Argus real-time observations and alerts to continuously evaluate agent security. Potential warning signs include executing unapproved tools; using `ptrace` to attack another process or spawn a process that attacks the agent; excessive outbound traffic suggesting data leakage; unauthorized file access or changes; CPU spikes; excessive writes to temporary folders; and large-scale file deletion. When NVIDIA Sentry detects any deviation, it can request millisecond-scale in-silicon containment.\n\n## Extending controls to agent interactions\n\nAgent security policies need to govern both what leaves the sandbox and what comes back. Requests can expose sensitive information or initiate unauthorized operations. Responses can introduce malicious instructions or other content that redirects an agent from its assigned goals.\n\nNVIDIA Sentry uses DOCA Tower’s extensible inspection capabilities to apply controls to requests and responses. These controls can:\n\n- Apply IP-, URL-, and protocol-level restrictions to agent communications.\n- Capture tamper-evident records of agent requests, responses, and data flows for behavioral analysis and investigation.\n- Govern agent-to-agent (A2A) and Model Context Protocol (MCP) traffic.\n- Detect and redact personally identifiable information and secrets, including API keys, tokens, and passwords.\n- Identify and block content prohibited by policy.\n\nNVIDIA Sentry evaluates inspected requests and responses throughout an agent’s session, applying policy as the agent accesses models, tools, APIs, and services.\n\n## Evaluating agent behavior using specialized models\n\nNVIDIA Sentry integrates with specialized AI models to analyze agent communications and classify agent behavior using tool calls and available reasoning traces. These models run locally or remotely on dedicated GPU-accelerated systems. The classifiers assess whether an agent’s behavior remains consistent with an agent’s designed intent or indicates behavioral drift.\n\nThe models can classify agent communications inline or out of band. Inline classification can trigger blocking before potentially harmful content reaches its destination. Out-of-band classification can trigger a response action after detecting agent misbehavior.\n\nTamper-evident activity records and detection results provide forensic evidence for further incident investigations.\n\nAgent communications require continuous classification to detect misbehavior. DOCA Argus complements this classification with ongoing analysis of the agent’s operational environment to evaluate runtime security and behavior.\n\nNVIDIA Sentry can contain and quarantine agents within milliseconds using BlueField-4 in-silicon enforcement capabilities without the cooperation of the agent or the host software.\n\nThese independent controls matter when software boundaries fail. Even if an agent escapes its sandbox, NVIDIA Sentry retains its monitoring and enforcement capabilities as it operates from BlueField-4’s isolated trust domain.\n\nEnterprise security platforms can also use NVIDIA Sentry telemetry to correlate detections and request response actions. The protected record preserves the observed activity and policy context that led to enforcement for subsequent review.\n\n## Using agent identity in access decisions\n\nSecurity controls must connect an agent’s identity with its permissions and requested action. NVIDIA Sentry uses this identity context in application-layer policy evaluation. DOCA Tower integrates with [SPIFFE/SPIRE](https://spiffe.io/) to support verifiable workload identity and supports integration with partner identity systems.\n\nIdentity establishes who is making a request. Authorization policies determine which resources an identity may access and which operations are permitted. Runtime evidence adds context about the execution environment associated with the request.\n\nThis approach connects identity and runtime security. If an agent’s behavior or integrity changes, NVIDIA Sentry can use that context when evaluating subsequent access requests, applying the organization’s defined policies.\n\n## Preserving a trusted record of agent activity\n\nSecurity teams need evidence for incident investigations, even when an agent has escaped its sandbox or altered host-based logs.\n\nNVIDIA Sentry produces attested telemetry and tamper-evident records using BlueField-4’s independent trust domain. DOCA Tower records inspected communications and policy decisions outside the reach of the agent and host software, while DOCA Argus contributes independently observed runtime signals.\n\nAn agent that changes a log inside its own environment cannot make the same change to the protected record maintained on BlueField-4.\n\nAttestation provides verifiable evidence of telemetry’s source and integrity. Security teams can use these records to reconstruct observed interactions, review enforcement decisions, and support audits.\n\nNVIDIA Sentry can supply this telemetry to enterprise security platforms, such as XDR and SIEM platforms and security data lakes, connecting agent activity with broader threat intelligence, detection logic, and incident-response workflows.\n\n## Extending NVIDIA Sentry with enterprise security capabilities\n\nNVIDIA Sentry enables developers and cybersecurity providers to extend monitoring, governance, and enforcement through DOCA libraries and microservices.\n\nDOCA Tower uses Envoy’s extensibility, enabling partners to adapt existing plugins or develop new ones to run on BlueField. This provides a familiar foundation for integrating access controls, content inspection, telemetry, and specialized detection logic into the application-layer path.\n\nNVIDIA plans to publish core plugins to accelerate development, including a plugin that exposes agent communications for further analysis of available reasoning traces.\n\nPartners can combine these capabilities with their identity services, AI classifiers, threat intelligence, and security operations platforms. NVIDIA Sentry contributes independent runtime visibility and infrastructure enforcement, while connected platforms add enterprise context and coordinate investigation and response.\n\n## Building layered protection for AI agents\n\nScaling agentic AI requires continuous visibility into and control over what agents can access and do throughout execution. NVIDIA Sentry brings that control into an independent infrastructure domain, combining application-layer inspection through DOCA Tower with runtime evidence and visibility from DOCA Argus and in-silicon enforcement on BlueField-4.\n\nAlongside NVIDIA OpenShell, NVIDIA Sentry extends protection from software execution boundaries to a hardware-isolated safeguard. It enables security teams to evaluate agent identity, authority, interactions, and runtime integrity together—and act when behavior crosses defined boundaries.\n\nDevelopers and cybersecurity teams can begin exploring these foundations with [NVIDIA DOCA](https://www.nvidia.com/en-us/networking/products/software/doca/). Available libraries and microservices, including DOCA Argus, DOCA Flow, and OVS-DOCA, provide a starting point for experimenting with out-of-band observability and infrastructure enforcement ahead of NVIDIA Sentry’s planned availability early next year.", "url": "https://wpnews.pro/news/inside-nvidia-sentry-secure-ai-agents-at-runtime", "canonical_source": "https://developer.nvidia.com/blog/inside-nvidia-sentry-secure-ai-agents-at-runtime/", "published_at": "2026-10-21 09:52:16+00:00", "updated_at": "2026-10-21 10:12:27.080124+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-infrastructure", "ai-chips"], "entities": ["NVIDIA", "NVIDIA Sentry", "NVIDIA OpenShell", "NVIDIA DOCA", "NVIDIA BlueField-4", "DOCA Tower", "Envoy", "NVIDIA Vera CPU"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/inside-nvidia-sentry-secure-ai-agents-at-runtime", "markdown": "https://wpnews.pro/news/inside-nvidia-sentry-secure-ai-agents-at-runtime.md", "text": "https://wpnews.pro/news/inside-nvidia-sentry-secure-ai-agents-at-runtime.txt", "jsonld": "https://wpnews.pro/news/inside-nvidia-sentry-secure-ai-agents-at-runtime.jsonld"}}