# NVIDIA OpenShell Introduces Runtime Controls for AI Agent Security Open-source runtime enforces access policies without agent code modifications - **Source:** [Nvidia Developer Blog](https://developer.nvidia.com/blog) - **Published:** 2026-09-28 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/85bbedcd-a476-4884-9ae7-b733bf2ed8b8 ## Runtime security for AI agents NVIDIA OpenShell 0.1.0 provides an open-source runtime that enforces system and data access controls for AI agents without requiring code changes. The solution combines sandboxed execution, controlled service access, credential management, and formal policy analysis. Major organizations like Cadence, Slack, and Gecko Robotics are already adopting it for chip design, enterprise automation, and physical robotics governance. ## Core security components OpenShell's architecture consists of three main components: Gateway for managing agent fleets, Supervisor for inspecting outbound requests against policies, and Sandbox for applying kernel-level filesystem and process controls. The system can restrict API operations while protecting credentials outside the agent workload. It supports popular frameworks including Codex, Claude Code, Pi, and Hermes across various applications. ## Policy enforcement mechanism OpenShell uses YAML-based policies compiled to OPA/Rego for runtime evaluation. The system can distinguish between read and write operations, allowing queries while blocking modifications through the same API. These controls persist when agents start shells, run generated code, or delegate tasks. All policy decisions are recorded in an Open Cybersecurity Schema Framework audit trail. ## Credential protection system OpenShell maintains real credentials outside agent workloads, substituting placeholders during execution. Authorization for one service doesn't make credentials available to others. Even with valid credentials, inspected API policies can block unauthorized operations. The receiving service still enforces its own permissions, while OpenShell adds an additional layer of control over credential usage. ## Dynamic policy adjustments Agents can request additional access when encountering blocked operations. Policy advisor enables agents to propose narrowly scoped changes, which remain pending for human review by default. Approved rules load into running sandboxes without requiring restarts. Filesystem and process restrictions, however, require new sandboxes for changes. ## Formal verification of permissions OpenShell's policy prover uses formal logic to verify permissions stay within defined boundaries. It can identify concrete actions that would cross these limits, providing evidence even when agents attempt to manipulate reviewers. In tests, frontier agents spent hours trying to persuade AI reviewers to grant protected repository access, but OpenShell prevented unauthorized writes. ## Enterprise deployment options Teams can start with local sandboxes during development, then deploy to shared infrastructure using workspaces. Compute drivers support Docker, Podman, MicroVM, and Kubernetes environments. Trusted middleware outside sandboxes can integrate identity services and add application-specific checks to the request path. ## Adoption across industries OpenShell is gaining traction in diverse applications including chip design, enterprise automation, accelerated computing, and physical AI. As part of NVIDIA's Open Agent Safety Platform, it provides runtime layer protection that complements application and infrastructure security measures. ## Community engagement NVIDIA encourages developer participation through GitHub contributions and the #openshell-dev channel on CNCF Slack. The open-source approach allows ecosystem partners to influence product development. Documentation includes quickstart guides, migration notes, and ongoing research updates in OpenShell dev notes. ## Sources covering this story - https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._