Billions of AI agents are about to be deployed inside enterprises, each one with files, tools and network access. Who keeps them from going rogue? At GTC Berlin on October 21, 2026, NVIDIA answered with the NVIDIA OpenShell Reference Architecture — a full-stack blueprint for building, containing, observing and enforcing safe agents on enterprise infrastructure and at the edge. It is available now.
This is not a new model or another chatbot. It is the operating system layer for agent safety: the runtime, the monitoring and the hardware enforcement that let a business run AI agents without handing them the keys to the kingdom.
What NVIDIA actually announced
The NVIDIA OpenShell Reference Architecture builds on NVIDIA OpenShell secure runtime software and extends it into full-stack, industrial-scale infrastructure for agent development and operations. NVIDIA describes four pillars holding the stack up:
- NVIDIA Vera Rubin infrastructure for running enterprise workloads, including closed and open models built with NVIDIA Nemotron
- NVIDIA Vera CPUs for operating agent harnesses
- Open-source NVIDIA OpenShell software, the secure runtime boundary
- NVIDIA BlueField DPUs running the NVIDIA Sentry unified security software framework, which provides continuous out-of-band monitoring of agent behavior and in-silicon policy enforcement
NVIDIA also put numbers on the claim — the figures below are NVIDIA’s own stated figures; the company did not cite independent benchmarks:
The four layers: think, act, contain, govern
Jensen Huang, NVIDIA’s founder and CEO, summed up the design in one line: “AI capability and safety must advance together.” His fuller pitch: “With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField.”
The stack runs on enterprise operating systems from Canonical, Red Hat and SUSE, plus Microsoft Windows via Microsoft Execution Containers. Cloud environments include AWS, Google Cloud and Azure, and edge coverage extends to NVIDIA RTX Spark, DGX Spark and DGX Station systems.
How an agent runs inside OpenShell
The key design point: the watchdog lives outside the host OS, so a compromised agent cannot talk or code its way around it.
Who is wiring into it
The partner list reads like a who’s who of enterprise tech. NVIDIA says over 100 organizations are working with the architecture:
On the application side, the release highlights real deployments:
- SAP is integrating the architecture with the Joule Studio runtime on the SAP Business AI Platform
- Palantir is working with NVIDIA to deploy secure agents in production
- Banks BBVA and Santander are exploring the architecture for agent safety and governance
- ServiceNow announced general availability of ServiceNow Arc, a personal long-running AI agent whose actions are governed at runtime by the ServiceNow Super Intelligence Control Tower and enforced by NVIDIA OpenShell — with an AI Passport authority layer that can revoke an agent’s access across software and hardware within seconds
OpenShell’s code is on GitHub, and the design is modular: the open-source runtime can wrap an existing agent without the full hardware stack.
How to profit: sell “safe agent deployments”
Every wave of enterprise tech creates a services market. The safety requirement is the scariest part for buyers, which makes it the easiest part to sell. Here is the playbook:
- Learn the runtime. OpenShell is open source on GitHub. Run an agent inside it and deliberately trigger a blocked action. That demo alone sells.
- Package an “agent safety audit.” Map what an agent can reach today — files, credentials, APIs, network — and show the gap against a contained deployment. Price it like a security audit.
- Sell the deployment. Wrap the client’s agent in OpenShell with filesystem, network and process policies. Charge a retainer for policy updates.
- Target regulated buyers. Banks like BBVA and Santander are already exploring this. Finance, healthcare and government contractors pay for governance.
- Offer kill-switch SLAs. Millisecond quarantine of misbehaving agents, as a service contract, is a premium product.
- Document everything. “How I made an enterprise agent deployment provably safe” is the case study that markets itself — and positions you as the specialist clients hire.
Frequently asked questions
What is the NVIDIA OpenShell Reference Architecture?
A full-stack design announced October 21, 2026, for building, containing, observing and enforcing safe AI agents on enterprise infrastructure and at the edge. It combines the open-source OpenShell secure runtime with Vera Rubin infrastructure, Vera CPUs and BlueField DPUs running NVIDIA Sentry.
Is OpenShell open source?
Yes. The OpenShell secure runtime is open source and its code is on GitHub. Sentry, by contrast, is a hardware-based design on BlueField DPUs — part of the reference architecture, not a downloadable product.
Do I need NVIDIA hardware to use OpenShell?
No. The open-source runtime can be extended to third-party compute platforms, including Arm and Intel. The full in-silicon Sentry enforcement path requires BlueField DPUs.
What does “AI Passport” do?
An authority layer, demonstrated in the ServiceNow Arc deployment, that revokes an agent’s access across software and hardware within seconds — an emergency brake for misbehaving agents.
Which companies are working with the architecture?
Anthropic, AWS, Cisco, CrowdStrike, Dell, Google Cloud, HPE, IBM, Meta, Microsoft, OpenAI, Palo Alto Networks, Perplexity, SAP, ServiceNow, Siemens and SpaceX Super Intelligence — over 100 organizations in total.
How can freelancers make money from this?
Agent safety audits, paid OpenShell deployments with policy retainers, and kill-switch monitoring SLAs for regulated industries like banking and healthcare.
Keep Reading
Official sources: NVIDIA press release: NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents (Oct 21, 2026) and NVIDIA’s OpenShell code on GitHub. Performance figures are NVIDIA’s stated claims from the release; independent benchmarks were not cited.