Nvidia lets AI agents do only what is allowed, and checks the rules in advance with mathematics

AI agents are AI programs that carry out tasks themselves: they look something up, write code, forward a file or pull data from a database. The more they are allowed to do on their own, the more useful they become. But then a company also wants to be sure that such an agent cannot get at data it does not need.

For that purpose, Nvidia presented a complete blueprint on 21 October 2026, at its GTC conference in Berlin. At its core is OpenShell: software that lets every agent work in a sealed-off space. According to Nvidia, the starting point is simple: an agent cannot guard itself. So something outside the agent has to do that.

A closed workshop with a gatekeeper

Compare it with a workshop that has a gatekeeper at the door. The agent works inside, in a closed space that developers call a sandbox. There it may only use the files and programs that have been assigned to it.

If the agent wants to do something outside that space, for example visit a website or call another service, the request goes past a separate component. That component checks whether it is allowed. Passwords and access keys also stay outside the workshop: the agent never gets hold of them itself.

OpenShell is open source, under a free licence (Apache 2.0). So anyone can use and inspect the software for free, also on hardware from other brands.

Checking the rules in advance with mathematics

What makes it special is the check of the rules themselves. A security expert sets out the most an agent may do: which programs, which data, which connections. With complex rules, a mistake easily creeps in, so that a combination of permissions suddenly allows more than intended.

OpenShell therefore uses formal verification: a calculation program uses mathematical logic to check whether there is any situation in which the rules cross that limit. If it finds such a situation, the expert is shown an example and the rules do not go live until the mistake has been fixed.

Such a proof is about the rules as they have been written down. It does not say that an agent always acts sensibly. Nvidia says so itself in its documentation: the check shows that the rules stay within the limit, and writing good rules remains work for people.

A guard in the chip

For large data centres, Nvidia goes one step further. In the blueprint, the AI models run on Nvidia's Vera Rubin systems and the agents on separate Vera processors. All traffic between agent and model runs through a network chip, the BlueField-4.

That chip runs its own guard, Sentry. It watches without the agent having to do anything for it, and without the agent being able to switch it off. If an agent tries to go beyond its limits, Sentry puts it in quarantine within milliseconds, according to Nvidia. Because the checking work happens on that separate chip, the servers could handle up to 20 per cent more agents at the same time, according to Nvidia. That figure comes from Nvidia itself.

Many well-known companies are taking part. Nvidia mentions, among others, model makers such as Anthropic, Google, Meta and OpenAI, security companies such as CrowdStrike, Palo Alto Networks and Zscaler, and banks such as BBVA and Santander, which are exploring the approach. ServiceNow already uses OpenShell in its own agent platform.

What is still to come

The software is available now, but it is still at the beginning: these are the first versions. Sentry is not open source; it is a design with open connections that Nvidia is working out further with partners. In the coming period it will become clear how companies use it in practice and how Nvidia's figures hold up in independent measurements.

What does this mean for the road to the singularity?

Agents that work independently are one of the big steps towards smarter AI. But companies only give them real responsibility if they can trust that an agent stays within the lines. OpenShell makes that trust checkable: not just promising that it is safe, but verifying it with mathematics and enforcing it with hardware.

AI itself can also help here. Writing rules for hundreds of agents is exactly the kind of puzzle where a language model can make suggestions and a mathematical check then strictly verifies whether they are right. That combination, a creative AI with a strict calculator beside it, could soon give agents more freedom without giving up safety.

What is the technological singularity? Read the explanation →