OpenShell Reference Architecture: Agents Governed in Silicon

NVIDIA used GTC Berlin on October 21 to publish something more consequential than another safety whitepaper: a reference architecture that turns agent containment into a hardware purchase order. OpenShell stays at the center as an Apache 2.0 runtime, wrapped in Vera Rubin for inference, Vera CPUs for the harness, and BlueField-4 DPUs running Sentry for enforcement. Jensen Huang's summary is the cleanest version of the design: agents "think on Rubin, act on Vera and be governed on BlueField."

That is an architectural decision, not a slogan. For two years the industry argued over whether agents should police themselves through better prompts or refusal training. NVIDIA's position is that none of that is a security boundary. It has to live somewhere the agent cannot reach or negotiate with, which means separate silicon.

The Three Planes, Separated on Purpose

Most agent stacks collapse everything onto one host: model endpoint, tool executor, credentials, and logging. That is convenient and structurally wrong, because a confused harness inherits all of it at once. OpenShell splits the workload across three planes with different trust levels.

• Inference plane. Vera Rubin NVL72 carries pretraining, post-training, and serving. NVIDIA claims 30x higher throughput per megawatt for agentic workloads, a figure that matters more than raw FLOPS because agent loops are token-hungry and long-lived.
• Execution plane. Vera CPUs run the harness and tool calls, positioned at 2x the performance of x86 with better efficiency, the relevant comparison for a workload dominated by process spawning, file I/O, and orchestration overhead.
• Enforcement plane. BlueField-4 DPUs run Sentry, the DOCA-based framework that watches agent behavior out of band and applies policy in hardware.

The separation is the entire point. The agent runs unprivileged inside a sandbox with no direct network access; its syscalls are filtered in the kernel, and requests leave through a single brokered channel to a supervisor outside the sandbox. The DPU then sits on the node's only path to the model, making it both the best observation point and the kill switch.

What Sentry Changes, and What It Does Not

Sentry quarantines an agent in milliseconds once it steps outside its software boundary. Running enforcement on a DPU rather than the host CPU means the policy engine is not a process the agent can kill, starve, or patch, and monitoring stays continuous and out of band. Nothing depends on the harness reporting honestly.

NVIDIA also claims Sentry raises agent capacity by up to 20%, presumably by moving policy evaluation off the cores that would otherwise run harnesses. Treat that as a vendor number until independent benchmarks exist, and apply the same caution to 30x per megawatt: it is a platform figure, while real agentic throughput depends on tool latency, context length, and how often the harness stalls.

The unresolved question is policy authorship. A prover can verify that a rule set stays inside an allowed access boundary, but it cannot encode what the operator meant. If a team grants broad egress because one workflow needed it once, the hardware will enforce that mistake faithfully and fast.

The Software Contract

The runtime underneath is unchanged from the September launch. The component list defines where integration work actually lands.

1. The gateway authenticates users, manages sandbox lifecycle, and ships policies and credentials to each sandbox.
2. The supervisor evaluates every request at binary, destination, method, and path level, applies policy updates live, and brokers credentials only where rules allow.
3. The policy prover checks proposed rules for boundary escapes before they take effect.
4. The sandbox runs the agent without privileges, filters syscalls in the kernel, and exposes no direct network path.

Support is broader than a typical NVIDIA stack: Linux and Kubernetes distributions from Canonical, SUSE, and Red Hat, Windows through Microsoft Execution Containers, and the operating systems behind AWS, Google Cloud, and Azure. It is harness-agnostic, with documented paths for Claude Code, Codex, OpenCode, OpenClaw, Hermes, and LangChain deep agents, plus RTX Spark and DGX systems at the edge.

ServiceNow is the most concrete integration: Arc is generally available with actions governed by its control tower and enforced by OpenShell, and the AI Passport layer can revoke access across software and hardware within seconds. SAP is wiring the architecture into Joule Studio. Everything else needs a slower read. Anthropic, OpenAI, Meta, CrowdStrike, Dell, HPE, and CoreWeave appear as partners, but "working with" spans a wide range of commitment, and banks such as BBVA and Santander are evaluating, not running production fleets.

What is genuinely new is that agent safety now has a hardware line item. Whether enterprises accept the split, or keep stuffing agents onto general-purpose hosts, is the question the next year will answer.