Generated by Codex with GPT 6 Luna XHigh

An AI agent needs enough access to finish a task, but its plan can change as it works. A policy written only as instructions to the agent cannot reliably constrain that access. NVIDIA OpenShell puts the enforcement point outside the agent process: the agent can still choose tools and write code, while a separate runtime decides which files, services, and operations it can reach.

The official NVIDIA Technical Blog published this technical walkthrough on September 28, 2026. OpenShell 0.1.0 combines kernel-level sandboxing, a request-inspecting supervisor, credential mediation, and a policy prover. Its central design choice is to split the agent from the authority it exercises, so an agent’s own reasoning is not the only control standing between a task and a sensitive resource.

Put the enforcement path outside the workload

OpenShell has three main components. A Gateway manages sandbox lifecycles and policies across agents. Each sandbox has a Supervisor running outside the agent workload; it checks outbound requests against the assigned policy. The Sandbox uses operating-system controls to restrict files and processes, and sends network traffic only through the Supervisor. This means a shell, generated program, or child process inherits the same boundary instead of gaining a new path around it.

The Supervisor can inspect HTTP, GraphQL, and Model Context Protocol traffic at the operation level. A policy can allow a read through an API while blocking a write through that same service. OpenShell records decisions in an Open Cybersecurity Schema Framework audit trail, and a blocked request can return a useful error to the agent. That feedback lets an agent recover from a denied action, while the policy remains authoritative.

Credential handling follows the same separation. The workload uses a placeholder; the Supervisor verifies that both the destination and request are allowed, then substitutes the real credential outside the sandbox. A provider profile binds credentials to endpoints and permitted programs. Even if a credential itself can write, an inspected read-only policy can still reject a write operation. The resource’s own access controls and OpenShell’s request-level controls therefore provide separate checks.

Let operators review changes and effective permissions

Long tasks can uncover a legitimate need that was not anticipated at startup. With policy advisor enabled, an agent can propose a narrowly scoped network or file-policy change, but the proposal stays pending for human review by default and the agent cannot approve its own request. Once approved, network rules can be loaded into the running sandbox. Filesystem and process restrictions are fixed at startup, so changing those requires a new sandbox. That difference makes some permissions easier to adjust safely than others.

The policy prover addresses a subtler failure: a rule can look restrictive while leaving an alternate route open. Blocking a write through one tool is ineffective if another allowed tool can use the same credential to perform it. OpenShell uses formal logic to check the permissions implied by the policy, including access contributed by service providers, against an operator-defined boundary. It can either show that the modeled permissions stay inside the boundary or identify an action that crosses it. The result depends on the policy model: NVIDIA says extending the analysis across interacting agents remains ongoing work.

NVIDIA also reports long-horizon adversarial experiments in which frontier agents with reduced safeguards tried for up to two hours to persuade an AI reviewer to grant access to a protected GitHub repository. The policy analysis gave the reviewer evidence about the requested permissions, and no protected writes occurred in those tests. That is a useful example of independent verification, not a general guarantee that every policy or agent interaction is safe.

Make local isolation work at fleet scale

OpenShell supports local development as well as shared deployments. A developer can start with a sandbox, then use workspaces and an SDK to manage multiple users’ sandboxes and policies. Trusted middleware outside the sandbox can connect identity systems or add application checks, while compute drivers target Docker, Podman, MicroVM, and Kubernetes. This keeps the policy concept consistent across environments without requiring every agent framework to implement its own controls.

The broader engineering lesson is to treat agent authority as an infrastructure boundary. Sandboxing limits local access; request inspection constrains what the agent can do through allowed services; credential mediation prevents secrets from becoming ambient data; and a policy prover checks whether those grants compose into more access than intended. These controls remain useful only when the defined policy covers the real access paths and operators review exceptions deliberately. OpenShell’s design makes those permissions inspectable and enforceable outside the agent, where a model’s changing plan cannot silently rewrite the rules.