NVIDIA Debuts OpenShell Reference Architecture for Agent Governance
NVIDIA announced the OpenShell Reference Architecture on October 21, 2026, at GTC Berlin, a full-stack design for building, containing, observing and enforcing safe AI agents acros…
NVIDIA announced the OpenShell Reference Architecture on October 21, 2026, at GTC Berlin, a full-stack design for building, containing, observing and enforcing safe AI agents across enterprise infrastructure and edge systems. The architecture is available now.
The architecture builds on NVIDIA’s open-source OpenShell secure runtime software, extending it into industrial-scale infrastructure for agent development and operations.It combines Vera Rubin infrastructure for running enterprise workloads, including closed and open models built with NVIDIA Nemotron; Vera CPUs for operating agent harnesses; and BlueField-4 DPUs running NVIDIA Sentry, a security framework that provides continuous out-of-band monitoring of agent behavior and in-silicon policy enforcement.
The design extends to agents running at the edge on RTX Spark, DGX Spark and DGX Station systems across retail, healthcare, manufacturing, robotics, software development and telecommunications.
“With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField,” said Jensen Huang, founder and CEO of NVIDIA. Huang said safety and control must be built into the computing architecture as enterprises prepare to deploy billions of AI agents.
At the core of the Vera Rubin infrastructure sit Vera Rubin NVL72 systems, which NVIDIA describes as fungible across pretraining, post-training and inference.The company states the NVL72 delivers 30x higher throughput per megawatt for agentic workloads.
Vera CPUs run the OpenShell software that provides a secure runtime boundary for autonomous agents, and NVIDIA states they deliver 2x the performance of x86 processors with greater energy efficiency.
A companion technical post describes Vera as a CPU built on 88 NVIDIA-designed Olympus cores with a second-generation Scalable Coherency Fabric, 96 lanes of PCIe Gen 6 and up to 1.2 TB/s of LPDDR5X memory bandwidth.
NVIDIA states the fabric provides up to 3x core-to-core bandwidth and up to 50% lower core-to-core latency than x86 alternatives, and that Vera delivers 2x more performance per watt than x86 CPUs.
CoreWeave, an AI cloud platform, measured sandbox startup at more than 3x faster on Vera than on x86, with a single rack supporting more than 11,000 concurrent agent environments, according to the post.
Running Terminal Bench, which measures CPU performance across real agentic loop tasks, CoreWeave found Vera delivered 1.8x faster performance versus x86 across tasks ranging from scripting to database recovery.
BlueField-4 DPUs running Sentry, built on NVIDIA’s DOCA software, continuously monitor agent behavior. If an agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds, according to NVIDIA. The company also states that Sentry on BlueField-4 boosts agent capacity by up to 20%.
NVIDIA’s position, stated in its technical post, is that an agent cannot govern itself, so security and governance belong in the infrastructure the agent operates in.OpenShell treats agent workloads as untrusted throughout execution, giving an agent access to what it needs only when it needs it.
The runtime has four components: Gateway, a control plane that manages sandbox lifecycles and policies; Supervisor, which checks outbound requests against policy and mediates access to credentials while running completely separate from the sandbox; Sandbox, which isolates the agent workload and restricts filesystem and process access; and Policy Prover, which applies formal verification to check whether a policy’s permissions stay within an organization-defined ceiling.
In the reference architecture, agents execute on Vera CPUs while BlueField-4 sits on the node’s only path to the model, so Sentry inspects agent-to-model communications without relying on the agent to report its own behavior, according to a technical deep dive on the framework.
Sentry operates from a hardware-isolated trust domain independent of host software and is designed to retain monitoring and enforcement capabilities even if an agent escapes its sandbox or the host is compromised.
DOCA Tower, Sentry’s AI security gateway built on the open-source Envoy proxy, acts as a transparent proxy for agent traffic and terminates TLS in silicon.DOCA Flow implements a layer-4 firewall for each agent, accelerated in silicon, blocking connections to unauthorized destinations and forwarding permitted traffic to DOCA Tower for application-layer inspection and authorization.
Access requests are evaluated against defined policies with the Open Policy Agent engine, which uses the Rego language and can evaluate requests in under a millisecond, depending on policy complexity and configuration.
DOCA Argus adds runtime context through agentless live memory introspection, analyzing selected regions of volatile host memory from BlueField-4 without host-resident agents. It maps containers to their pods and sandboxes to microVMs and tracks processes, file access, n