NVIDIA Pushes Agent Enforcement Into the Silicon, and Publishes the Blueprint

NVIDIA announced the OpenShell Reference Architecture at GTC Berlin, a full-stack blueprint that pushes agent governance from software into hardware across four layers: Vera Rubin infrastructure for inference, Vera CPUs running the open-source OpenShell runtime, BlueField-4 DPUs running the Sentry security framework for out-of-band monitoring and in-silicon policy enforcement, and RTX Spark, DGX Spark and DGX Station systems at the edge. The published documentation, "Building secure agent workspaces" on docs.nvidia.com, defines a secure agent workspace with seven logical planes, a Trusted Access Broker and Credential Proxy, two phases of controls, and a threat model assuming the VM's operating system is already compromised, with reference implementations for Red Hat OpenShift and Microsoft Azure. NVIDIA claims 30x higher throughput per megawatt for agentic workloads on Vera Rubin NVL72 systems, 2x the performance of x86 processors on Vera CPUs, quarantine of a boundary-crossing agent in milliseconds, and up to 20 percent more agent capacity from Sentry on BlueField-4; the figures are NVIDIA's claims and not independently verified.

NVIDIA announced the OpenShell Reference Architecture https://nvidianews.nvidia.com/news/openshell-reference-architecture at GTC Berlin today, the third act in a fast sequence: the OpenShell runtime https://forkast.news/nvidia-openshell-ships-policy-based-sandboxing-as-a-runtime-enforcement-layer-for-autonomous-agents/ shipped September 16, the Open Agent Safety Platform https://forkast.news/nvidia-bakes-agent-security-into-the-silicon-launches-open-agent-safety-platform-with-120-partner-coalition/ followed September 28, and today’s release turns that platform into a published, full-stack blueprint for industrial-scale agent operations. The stated target is the primary bottleneck https://forkast.news/tgvp-infrastructure-not-model-quality-is-the-primary-bottleneck-to-enterprise-ai-agent-adoption/ to enterprise agent adoption: governance, pushed down from the application layer into the hardware. The architecture has four legs. NVIDIA Vera Rubin infrastructure runs inference for closed and open models. NVIDIA Vera CPUs operate the agent harnesses and run the open-source OpenShell software, which provides the secure runtime boundary around each agent. NVIDIA BlueField-4 DPUs run the NVIDIA Sentry security framework, built on NVIDIA DOCA, for continuous out-of-band monitoring of agent behavior and in-silicon policy enforcement. The stack extends to the edge through NVIDIA RTX Spark, DGX Spark and DGX Station systems. Jensen Huang, founder and CEO of NVIDIA, framed it in the release: “AI capability and safety must advance together. As enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture. NVIDIA created OpenShell to give agents the freedom to do useful work within clearly defined boundaries – contained, monitored and under control. With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField.” The published documentation, Building secure agent workspaces https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/index.html on docs.nvidia.com, is where the blueprint gets specific. It defines a secure agent workspace organized into seven logical planes, with a Trusted Access Broker and a Credential Proxy that decides where tokens live. Inference is treated as a hard dependency rather than a workspace feature. The governance model ships two phases of controls: baseline workspace controls first, agent runtime controls second, alongside a threat model that assumes the operating system inside the virtual machine is already compromised. Deployment tiers include a Sentry Integration Profile, and reference implementations exist for Red Hat OpenShift and Microsoft Azure. The structural move is the enforcement locus. When the rulebook runs out-of-band on a DPU, it sits beneath the agent’s reach and beneath the software layer the agent was built on. That is the design principle NVIDIA’s own platform launch emphasized: enforcement must happen beyond the agent’s reach, and the path to the model is the critical control point. It also relocates the lock-in question. A policy layer in software can be swapped; a policy layer wired into the accelerator is harder to route around. The performance numbers attached to that layer are NVIDIA’s claims, not independently verified measurements: 30x higher throughput per megawatt for agentic workloads on Vera Rubin NVL72 systems, 2x the performance of x86 processors on Vera CPUs, quarantine of a boundary-crossing agent in milliseconds, and up to 20 percent more agent capacity from Sentry on BlueField-4. The week’s pattern matters as much as the product. Four governance layers shipped independently in days, with no shared ratified specification binding any of them: Okta advanced identity-governed short-lived tokens https://forkast.news/okta-advances-agent-identity-framework-as-market-builds-around-pre-ga-standards/ at the platform layer, CAEVES shipped a managed context service https://forkast.news/caeves-ships-context-lake-enterprise-context-as-a-managed-mcp-service/ over the Model Context Protocol https://forkast.news/glossary/model-context-protocol-mcp/ , Rhapsody built a healthcare-native gatekeeper https://forkast.news/rhapsody-guardian-healthcare-builds-its-own-agent-gatekeeper-ahead-of-any-shared-spec/ for the regulated vertical, and NVIDIA now anchors enforcement in silicon. AGNTCon opens in San Jose this week against that gap: the specifications under discussion remain unratified while the enforcement locus is being settled in shipping products. The partner roster carries different weights, and the release’s own verbs say so. ServiceNow announced general availability of ServiceNow Arc, a long-running agent whose actions are governed at runtime by its control tower and enforced by OpenShell, with the AI Passport authority layer carrying revocation policy to OpenShell and Sentry so enterprises can revoke an agent’s access across software and hardware within seconds. SAP is integrating the architecture with its Joule Studio runtime. Palantir and NVIDIA are working with customers to deploy secure agents in production. BBVA and Santander are working with NVIDIA to explore the architecture as a governance framework: exploration language, not deployment. The long tail of model builders, cybersecurity vendors, system manufacturers, cloud providers and inference services is mostly framed as working with the architecture or building integrations. The release closes with its own qualifier: many of the described products and features remain in various stages and will be offered on a when-and-if-available basis. What is actually available today is the reference design and its documentation, and that is not nothing: a buildable blueprint with reference implementations moves the conversation from aspiration to deployment planning. But the skepticism recorded at the platform launch in September still stands against today’s claims. NVIDIA has not published specific performance benchmarks showing how the quarantine and enforcement machinery holds up under extreme stress, and 20 percent capacity and millisecond containment are vendor figures until someone independent measures them. For enterprise architects, the question to watch is no longer whether enforcement descends into the hardware; today it did. The question is whether that enforcement layer becomes shared infrastructure or a vendor moat, and the next signal is whether these reference implementations get adopted on their own terms or only inside one vendor’s stack.