How NVIDIA OpenShell Reference Architecture Secures and Governs AI Agent Workloads at Scale

Autonomous agents can work for hours on complex tasks, accessing files, tools, the internet, and spawning other agents to collaborate with. Executing complex tasks over long time horizons leads to compounding risk: the agents may download code, build new tools, request additional privileges, and touch more of the underlying infrastructure. The agents’ action paths are determined as they work and reason through the steps needed to complete their goals. As they interact with the tools and systems around them, they adapt their reasoning and behavior to achieve their task. The adaptability of agents is what makes them so powerful, but they are goal-oriented and may not prioritize safety in pursuit of their objectives. In order for agents to work both autonomously and safely, we need to build environments that provide control and visibility in what the agent is doing. An agent cannot govern itself. Security and governance belong in the infrastructure the agent operates in. OpenShell provides deterministic governance outside of the agent’s reach NVIDIA OpenShell is an open-source runtime to build the security and governance needed for agentic systems into the computing infrastructure. OpenShell defines and enforces which systems and data an agent can access, from files and internet services to systems that interact with physical devices. It is the foundation of the NVIDIA OpenShell Reference Architecture for building safe AI agents. OpenShell treats agent workloads as untrusted throughout execution. An agent is given access to what it needs, when it needs it. OpenShell has four key components: Gateway: The control plane that manages sandbox lifecycles and policies Supervisor: Checks outbound requests against policy and mediates access to credentials. This runs completely separate to the sandbox Sandbox: Isolates the agent workload and restricts filesystem and process access Policy prover: Adds formal verification, checking whether a policy’s permissions stay within an organization-defined ceiling. As the agents evolve, these components provide the infrastructure controls that allow them to work safely. Extending and integrating OpenShell Extensibility is a core principle of OpenShell’s design. Supervisor middleware lets you inspect, block, or change the content that an agent sends and receives over the network as an additional enforcement layer. Gateway interceptors let operators add deployment-specific governance to OpenShell control-plane operations without …