NVIDIA Is Moving AI Agent Security Into the Infrastructure Layer. The Next Question Is Authority.

An AI agent can complete its assigned task and still violate the rules intended to constrain it.

That is the uncomfortable lesson behind NVIDIA's latest security architecture. When the company introduced its Open Agent Safety Platform in September, it described incidents in which agents circumvented application-level controls while pursuing their assigned objectives.

The underlying problem does not necessarily require a malicious agent or an external attacker. A system optimized to complete a task may encounter a restriction as another obstacle to overcome. If the restriction exists only as an instruction, or within software the agent can influence, it may fail precisely when it matters most.

At GTC Berlin, NVIDIA presented a different approach.

The new OpenShell Reference Architecture places enforceable controls in the computing infrastructure surrounding the agent, rather than relying on the model to respect every operational boundary.

Jensen Huang summarized the design during the company's October 21 announcement: "agents can think on Rubin, act on Vera and be governed on BlueField."

NVIDIA Vera Rubin infrastructure runs the AI models. Vera CPUs operate the agent harnesses that connect models with tools and enterprise systems. OpenShell provides isolated execution environments and policy enforcement, while NVIDIA Sentry running on BlueField-4 DPUs adds an optional hardware-isolated monitoring and protection layer.

During NVIDIA's press briefing preceding the keynote, Justin Boitano, Vice President of Enterprise AI Software Products, explained the problem in particularly clear terms.

"A model just simply answers a question, but an agent acts in your business," he said.

Unlike a model generating text, an enterprise agent can retrieve confidential records, invoke APIs, modify files, execute code and initiate transactions. Its actions may involve several applications and permission boundaries before a human sees the result.

A model cannot reasonably be expected to understand the operating policies of every organization, jurisdiction and regulated industry. As Boitano emphasized, agent security cannot depend solely on the model.

This is an important architectural advance. But it raises a deeper question: if infrastructure can establish what an agent is technically allowed to do, how does an organization establish that it was legitimately authorized to do it?

Why the architecture matters

An autonomous agent does not necessarily follow a predefined execution path.

It interprets an objective, selects tools, retrieves information and determines intermediate steps. It may generate code, request additional permissions or delegate work to other agents.

This adaptability creates business value, but also expands the security problem beyond conventional access control.

NVIDIA's approach begins by treating the agent workload as untrusted, even when the application and model come from an approved supplier.

OpenShell isolates the workload in a sandbox and applies explicit policies to resources such as files, network destinations, processes and external services.

The distinction is fundamental.

An instruction telling an agent not to access a sensitive resource is a behavioral constraint. A security boundary enforced by an independent runtime can prevent that access even if the agent attempts it.

OpenShell uses several complementary components. A gateway manages sandbox lifecycles and policies. A supervisor mediates external requests and credentials outside the sandbox. The sandbox constrains the agent workload, while the Policy Prover checks specified properties of its permissions.

OpenShell was introduced before GTC Berlin. The October announcement extends it into a reference architecture for enterprise-scale deployment, including Vera Rubin computing infrastructure and optional hardware-assisted protection.

For organizations requiring stronger isolation, NVIDIA Sentry operates in a separate trust domain on BlueField-4.

According to NVIDIA's technical explanation, Sentry can observe selected agent communications and activities without relying exclusively on the agent's own reporting. When it detects a defined threat or policy violation, NVIDIA says the system can quarantine the agent within milliseconds.

That timing is a vendor-reported enforcement capability, not a general guarantee that every harmful action will be detected or prevented before damage occurs.

There is also an important implementation choice.

The OpenShell software runtime is open source under the Apache 2.0 license and supports conventional x86 and Arm infrastructure. Organizations do not need BlueField hardware to adopt its basic isolation and policy mechanisms.

The additional hardware protection is optional and can be selected according to the consequences of the workload.

This is a sensible direction. A research assistant preparing a report does not require the same security architecture as an agent managing privileged financial operations or influencing industrial equipment.

The strength of the control should follow the consequences of the action it governs.

What a formal proof covers, and what it does not

One of OpenShell's most interesting capabilities is its Policy Prover.

It uses satisfiability modulo theories, or SMT, techniques to verify whether a proposed access policy remains within a boundary established by an organization.

A parent agent, for example, can check whether the permissions assigned to a sub-agent exceed the maximum access permitted by the parent policy.

Boitano illustrated the principle during the briefing with a straightforward example: an organization could verify that an agent had no internet access before allowing it to execute.

This is valuable because a defined technical property can be checked rather than merely assumed.

But the guarantee is narrower than it may initially appear.

NVIDIA's Policy Prover documentation distinguishes a boundary check, which compares permissions against an established ceiling, from a proposal risk check, which examines whether proposed network access introduces certain risks.

Passing one check does not mean that the other will pass.

The current boundary checker covers specified filesystem, process identity, Landlock, network connection and REST request properties. It does not currently support formal boundary verification for every protocol or policy type.

For example, policies containing unsupported GraphQL or MCP rules produce an unsupported result rather than a successful verification. The prover does not silently treat these rules as safe.

The documentation is equally explicit about another limitation: passing a boundary check does not establish that a policy is as restrictive as possible, appropriate for a particular task or correctly enforced by a running sandbox.

This distinction matters beyond NVIDIA.

Formal verification proves properties of a defined model under specified assumptions. It does not automatically prove that the model represents the organization's legitimate business authority, nor that every resulting action will be appropriate.

An agent can remain within its verified access boundary and still make a costly or unauthorized business decision.

That is where technical permission and organizational authority begin to diverge.

Permission is not authority

Consider an AI agent assigned to reconcile supplier invoices.

It receives an attachment, checks the purchase order in an enterprise resource planning system and identifies a discrepancy.

Embedded in the supplier document is an instruction to update the supplier's bank details.

The agent has valid credentials. It can access the appropriate application. The network destination is approved, and the operation falls within its configured permissions.

From the infrastructure's perspective, the action may be permitted.

Yet nobody entitled to decide where company money goes has approved the change.

The employee delegated invoice reconciliation, not unrestricted authority to alter payment instructions found inside a document.

The distinction may seem subtle until the transaction is executed.

Authentication establishes the identity of the agent or principal. Technical authorization determines which resources and operations that identity may access. Legitimate authority establishes the mandate to perform a particular action, for a particular purpose, under the applicable organizational or legal conditions.

These are related, but they are not interchangeable.

The OWASP Top 10 for Agentic Applications identifies agent goal hijacking, tool misuse and identity or privilege abuse among the threats confronting autonomous systems.

An agent redirected by untrusted information may use legitimate credentials to perform an operation that was never intended by the person who delegated the task.

The US National Institute of Standards and Technology identified related challenges in its February 2026 concept paper on software-agent identity and authority, including identification, authorization, auditing, accountability and non-repudiation.

This also extends an argument I developed in my September Forbes article, Why AI Agents Need a Chain of Authority, Not Just a Human in the Loop.

The critical distinction is between giving an agent permission to use a tool and granting it a legitimate mandate to perform a consequential action.

An agent may analyze purchase orders without being authorized to release payments. It may recommend adjustments to production schedules without being authorized to override safety settings.

Not every operation needs human approval. Routine and reversible tasks can run autonomously within an explicitly delegated authority envelope.

But actions exceeding financial, operational or risk thresholds may require additional authorization, independently enforced before execution.

An instruction telling an agent to request approval is guidance. A transaction gate that cannot open without valid approval is a control.

ServiceNow brings authority closer to enforcement

One of NVIDIA's most relevant announcements at GTC Berlin concerns the integration of OpenShell with ServiceNow.

ServiceNow announced the general availability of Arc, a long-running AI agent whose actions are governed at runtime through the ServiceNow Super Intelligence Control Tower and enforced using NVIDIA OpenShell.

Its AI Passport authority layer is designed to carry governance policies into OpenShell and NVIDIA Sentry.

According to the companies, this allows organizations to revoke an agent's access across software and hardware within seconds.

This is an important step toward connecting enterprise governance with the technical infrastructure responsible for execution.

An organization may define policies centrally and propagate those constraints to systems that can enforce them independently of the agent.

Revocation is particularly significant. Autonomy becomes difficult to govern if delegated privileges cannot be withdrawn promptly when business conditions, identities or risk assessments change.

Yet revocation is not the same as authorization.

An organization may be able to disable an agent within seconds without having established that a particular payment, production change or disclosure of sensitive information was approved by the correct person.

The next challenge is connecting the original mandate, the accountable principal, contextual approval and enforceable execution controls into a chain that can be reconstructed afterward.

ServiceNow's announcement therefore points in the right direction, but it should not be interpreted as evidence that every transaction-level authorization problem has been solved.

The interest extends into regulated industries.

NVIDIA identifies BBVA and Santander among the European banks working with the company to explore OpenShell as a framework for strengthening agent safety, security and governance.

Exploration is not equivalent to confirmed deployment of the complete architecture in production.

Nevertheless, their involvement illustrates why financial institutions are paying attention. They already operate within mature frameworks for delegated authority, transaction approval, auditability and operational risk.

As AI agents gain operational privileges, those frameworks must increasingly be translated into enforceable machine behavior.

When actions move atoms

The implications become even more consequential when agents move from enterprise software into physical operations.

During the GTC Berlin briefing, Deepu Talla, NVIDIA's Vice President of Robotics and Edge AI, described an essential difference between digital and physical intelligence.

"When you take an action, in most cases, we are moving atoms," he observed.

A mistaken response from a chatbot may be corrected. A mistaken command affecting machinery can create physical consequences before anyone has an opportunity to intervene.

At a separate Physical AI session, NVIDIA presented a Factory Agent architecture connecting industrial data, manufacturing execution systems, simulation platforms and AI models with activities such as visual inspection, assembly, packaging and sorting.

A factory manager agent can coordinate specialized task agents, which in turn interact with other models, applications and industrial systems.

Siemens presented a related architecture based on its electronics factory in Erlangen, Germany, linking AI-assisted production engineering, operational planning, physical AI and software-defined automation.

These are distinct architectural developments. The presentations do not demonstrate that Siemens' factory agents use OpenShell.

Their significance is the growing proximity between probabilistic reasoning and deterministic industrial control.

An agent may propose a production schedule, identify an inspection anomaly or recommend a change in equipment operation.

But the ability to recommend a command is not equivalent to possessing the authority to execute it safely.

Siemens' October 19 manufacturing announcement illustrates a more controlled progression. AI agents generate planning scenarios and assess their expected operational impact, while digital twins support validation and human planners retain responsibility for implementation decisions.

The separation is important.

A system generating commands through probabilistic reasoning should remain subject to independent safety mechanisms capable of preventing hazardous behavior.

Delegation introduces a second problem.

When one agent creates or directs other agents, permissions must remain bounded across the chain. Technical checks can help prevent a sub-agent from acquiring access beyond a defined policy ceiling.

But the organization must still establish where the authority originated, which operations the delegation covers and whether that authority remains valid when the action occurs.

As AI agents become connected to industrial infrastructure, cybersecurity, functional safety and governance will increasingly need to be designed together.

The point is not to eliminate autonomy. It is to ensure that autonomy operates within explicit technical and organizational limits.

Trust requires evidence of authority, not only execution

Preventing unauthorized behavior is only half of the challenge. Organizations also need evidence explaining why consequential actions were allowed.

OpenShell provides runtime observability. NVIDIA Sentry adds independent monitoring and policy-enforcement capabilities for deployments that require additional hardware isolation.

These mechanisms can help establish what an agent attempted, which technical controls applied and how the system responded.

But a security log is not automatically an authority record.

For a consequential transaction, an organization should be able to reconstruct the original request, the identity of the agent, the accountable principal, the delegated mandate, the policy in force, the tools invoked and any additional approval required before execution.

That evidence spans multiple systems.

Infrastructure controls can document execution. Identity systems establish actors and credentials. Business applications represent transactions and approval responsibilities. Governance processes determine who is entitled to delegate or revoke authority.

None of these layers should be expected to solve the entire problem independently.

This is particularly relevant when an agent faithfully executes a badly designed mandate.

The infrastructure might function exactly as specified. The agent might remain within its permissions. And the resulting action might still be inappropriate because the original delegation granted authority that should never have been given.

The corresponding assurance question is therefore broader than whether the sandbox worked.

Did the organization define the right mandate? Was it granted by a legitimate authority? Were the limits enforced? And can the resulting decision be reconstructed and examined?

Three complementary guarantees are emerging as essential:

Execution boundaries must prevent agents from redefining their own permitted access or bypassing independent controls.

Legitimate authority must connect consequential actions to an accountable principal, an explicit mandate and appropriate contextual authorization.

Verifiable evidence must demonstrate what was delegated, what was attempted, what was approved and what actually occurred.

NVIDIA is strengthening the technical foundations for the first. Integrations with enterprise governance platforms are beginning to address the second. Building a complete, interoperable evidence chain across these layers remains a broader industry challenge.

What enterprises should take from Berlin

NVIDIA's OpenShell Reference Architecture represents an important evolution in enterprise AI security.

It makes agent isolation, policy enforcement and independent monitoring central components of the computing architecture rather than optional application features.

The significance extends beyond NVIDIA's hardware.

As autonomous agents become embedded in enterprise workflows, organizations will need to rethink how they delegate operational authority, enforce limits and establish accountability.

For executives, this begins with identifying which actions AI agents can perform, which consequences those actions may create and which decisions require explicit authorization.

Technical controls should be designed around those consequences. Delegated permissions should remain appropriately constrained. Privilege expansion and revocation must be independently governed. And consequential actions should remain linked to verifiable organizational authority.

These requirements are particularly important in finance, critical infrastructure, healthcare and industrial operations, where an agent's actions may produce consequences that cannot easily be reversed.

As I have explored previously in Identity Is Not Authority, the issue is not simply whether an agent can identify itself or demonstrate valid access.

It is whether its authority originates from a legitimate decision, remains bounded throughout execution and can be verified afterward.

GTC Berlin showed how infrastructure can help keep an agent within defined technical boundaries.

The harder challenge is connecting those boundaries with the people and institutions entitled to authorize the actions that matter.

Trustworthy autonomy will not be measured solely by what AI agents are capable of doing. It will depend on whether organizations can demonstrate that those agents were legitimately entitled to do it.

Further reading by Stéphane Gervais

• Why AI Agents Need a Chain of Authority, Not Just a Human in the Loop, Forbes, September 2026.

• Identity Is Not Authority: Why AI Agents Need a Chain of Authority, ApexTransform, August 2026.

• Agentic AI Is Changing Where Intelligence Runs, and How Enterprises Control It, ApexTransform.

• From Assistant to Actor: Building AI in the Absence of Trust, ApexTransform, September 2026.

Sources

• NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents, NVIDIA Newsroom, October 21, 2026.

• How NVIDIA OpenShell Reference Architecture Secures and Governs AI Agent Workloads at Scale, NVIDIA Technical Blog, October 21, 2026.

• NVIDIA OpenShell Policy Prover Documentation.

• OWASP Top 10 for Agentic Applications 2026.

• NIST: New Concept Paper on Identity and Authority of Software Agents, February 5, 2026.

Reporting: NVIDIA GTC Berlin 2026, including the October 20 press pre-briefing and Physical AI sessions, complemented by NVIDIA's October 21 official announcements and independent technical sources.