NVIDIA Draws the Blueprint for Safe Agents: OpenShell Reference Architecture Puts Vera Rubin, Vera CPUs and BlueField-4 Around Every Agent

NVIDIA has spent 2026 telling enterprises that AI agents need fences, not vibes. At GTC Berlin this week the company turned that argument into a formal product: the OpenShell Reference Architecture, a full-stack blueprint for running AI agents inside company systems under enforced limits. The announcement, published alongside Jensen Huang's keynote, assembles hardware NVIDIA already sells into a single governed pattern — and it comes with a partner list long enough to look like an industry standard rather than a vendor preference.

The division of labor is explicit. Vera Rubin NVL72 systems run model inference, with NVIDIA claiming agent workloads reach up to 30 times the throughput per watt of the previous generation on that configuration. Vera CPUs carry the agent harness and tool execution, a job NVIDIA says the chip performs at twice the rate of comparable x86 processors. BlueField-4 DPUs run NVIDIA's Sentry software for out-of-band monitoring — policy enforcement that lives outside the agent's own operating environment, so a prompt-injected model cannot talk its way past it. NVIDIA claims Sentry can isolate a misbehaving agent in milliseconds; the company notes the figure is its own and independent validation is still pending.

The software layer stays open. OpenShell itself is Apache 2.0 licensed (v0.1.0) and runs on any hardware, a deliberate hedge against the obvious criticism that the reference architecture binds buyers to NVIDIA silicon. One caveat matters for procurement: Sentry is currently a reference design, with general availability targeted for early 2027, so hardware-enforced revocation is a promise with a date rather than a shipping feature.

The ecosystem around the blueprint is unusually broad. CrowdStrike, Palo Alto Networks, Zscaler and Check Point announced integrations. SAP is wiring the architecture into its Joule Studio runtime. BBVA and Santander are evaluating it as a governance framework. On the model side, agents built with Anthropic, OpenAI, Google, Meta, Perplexity and Cohere stacks can run inside OpenShell, and operating system support spans Canonical, SUSE and Red Hat, with Microsoft contributing Windows support. Dell, Cisco, HP and Lenovo appear among the system makers.

ServiceNow is the first enterprise software vendor shipping on the architecture. Its Arc personal agent — which works across ServiceNow workflows, email and Teams — can run inside an OpenShell runtime or on an employee desktop, and when an AI Passport is revoked, BlueField can enforce the revocation before the agent proceeds. Arc ships at no extra cost with EmployeeWorks Foundation, Advanced and Prime SKUs; Mac support is live, with Windows expected within weeks. Huang's framing of the agent stack — model, harness, sandbox, knowledge and tools — mapped each element to a piece of NVIDIA's portfolio.

The keynote version of the pitch was blunter than the press release. Huang argued that "please don't" safety — instructing an agent not to delete databases, touch SSH keys or push to main — is not a security model, and that boundaries must be enforced by infrastructure the agent cannot rewrite. That is a direct answer to the year's accumulating horror stories, from agents leaking credentials to the OpenAI Hugging Face sandbox escape that Microsoft has cited in its own agent-security push.

The honest critique is structural. The full architecture assumes NVIDIA GPUs, NVIDIA CPUs and NVIDIA DPUs, so hardware-level safety arrives bundled with deeper stack lock-in, and the millisecond-quarantine claims still await third-party testing. But the direction is set: agent governance is moving from policy documents and API gateways into silicon, and every serious buyer will now ask vendors whether their agents can be revoked at the hardware level — and what happens when the answer is no.