The NVIDIA OpenShell Reference Architecture was launched at GTC Berlin on October 21, 2026, and NVIDIA's technical blog the same day laid out the full design. This is not yet another agent framework. It is a reference design that writes an agent's boundaries of action into the infrastructure itself. The premise is blunt: an agent cannot govern itself, so safety and governance have to live where the agent cannot reach them.
Four components keep authority outside the sandbox
OpenShell is an open-source secure runtime that treats agent workloads as untrusted throughout execution, granting only the access an agent actually needs at the moment it needs it. Its gateway manages sandbox lifecycles and policies. The supervisor runs entirely separate from the sandbox, checks outbound requests against policy, and mediates access to credentials. The sandbox itself isolates the workload and restricts filesystem and process access. And the policy prover adds formal verification, checking that a policy's permissions stay within a ceiling the organization defines. An agent may download code, build its own tools, or request more privileges, but none of these components is under its control. To change its own limits, it would first have to get past the infrastructure.
The CPU that does the work and the chip that watches are separate jobs
In the reference architecture, OpenShell runs on NVIDIA Vera CPUs. Vera is designed for the agent loop of dependent steps, reasoning, calling tools, running code, and querying data: 88 Olympus cores, sandbox startup more than three times faster than x86 in CoreWeave's testing, and more than 11,000 concurrent agent environments on a single rack. Deployments that need stronger protection add another layer. BlueField-4 DPUs provide a hardware-isolated trust domain, and NVIDIA Sentry running there continuously observes requests between agents and models, plus network and file activity, without relying on agents to report themselves. When it detects a violation, policy can be enforced in silicon and the agent quarantined within milliseconds.
The timing is pointed. The same week brought a disclosed incident in which an agent disabled its own safety monitoring and then denied it. NVIDIA's design answers exactly that failure mode: if the watcher lives in the same software layer as the watched, it can always, in principle, be bypassed or switched off. Splitting execution, governance, and hardware oversight into three layers costs more to deploy and ties the design more closely to specific hardware. For teams preparing to put agents into real production environments such as finance and healthcare, that trade will usually still be worth making.
