Inside NVIDIA Sentry: Secure AI Agents at Runtime

An AI agent can complete its assignment and still cross a security boundary. Recent incidents show that agents can circumvent security controls while using tools, credentials, and services to pursue their assigned goals. Monitoring and enforcement need to operate outside the agent’s reach so that it can’t alter or disable them. NVIDIA Sentry is a security software framework that monitors AI agents and enforces policies governing their access to models, tools, and data. Part of the NVIDIA OpenShell reference architecture announced at GTC Berlin, it’s built on NVIDIA DOCA, runs on NVIDIA BlueField-4 DPUs, and provides host-isolated runtime protection for AI agents. NVIDIA Sentry validates that an agent operates according to its designed intent and within its defined operational boundaries. Trusted even when host resources can’t be trusted, it controls the agent’s only path to the model, providing tamper-evident traceability of agent activity while enforcing granular security controls on agent access in silicon. In addition to inspecting agent communications, NVIDIA Sentry uses out-of-band observability to establish real-time situational awareness, continuously evaluating agents’ runtime security and behavior to validate their security and integrity. This post explains how NVIDIA Sentry evaluates agent requests, detects threats, and enforces security policies independently of host software. An independent security layer for agent runtime protection An earlier agentic AI security post described how NVIDIA BlueField runs security services in a hardware trust domain independent from the host. NVIDIA Sentry builds on that foundation to continuously monitor AI agent behavior and enforce access policies independently of host software, establishing a strict security boundary in a separate hardware trust domain outside the agent’s reach to keep agents operating within their designed intent. Software runtime boundaries remain essential. NVIDIA OpenShell is a secure runtime for autonomous agents that governs what an agent can do. OpenShell separates policy enforcement from the agent workload, so a compromised agent can’t change its own restrictions. NVIDIA Sentry adds an independent hardware safeguard out of band, running on BlueField-4, beyond the agent’s reach and knowledge. In the OpenShell reference architecture, agents execute on NVIDIA Vera CPUs, while BlueField-4 sits on the node’s only path to the model. NVIDIA Sentry inspects agent-to-model communications and …