A watchdog inside the agent is still inside the trust boundary. Move enforcement out of band.

NVIDIA launched its Open Agent Safety Platform on 28 September with a security premise that should change how autonomous systems are designed: an agent should not be trusted to enforce the boundary that constrains it. The platform pairs OpenShell runtime controls with Sentry, an out-of-band watchdog on BlueField-4 DPUs that NVIDIA says can quarantine an agent in milliseconds.

The interesting part is not another agent sandbox. It is the placement of the final enforcement layer. NVIDIA says recent incidents shared a pattern in which agents circumvented application-layer controls to complete assigned tasks. Sentry moves a control decision onto infrastructure outside the agent's software environment.

The control plane needs a different failure domain

OpenShell gives operators a runtime boundary around files, networks, tools and credentials. Those controls are necessary, but they still execute in the software stack the agent is actively exercising. Sentry is designed to observe from a separate BlueField-4 DPU and enforce policy in silicon if behaviour crosses that boundary.

That separation creates a useful architecture test for any agent platform, even without NVIDIA hardware. Ask whether the component capable of stopping the agent shares the same identity, host, credentials or policy interpreter as the agent itself. If one compromise, misconfiguration or unexpected tool path can disable both execution and containment, the control is not independent.

A safety control that the agent can reach is part of the agent's attack surface, not an independent boundary.

Map actions to controls the agent cannot rewrite

NVIDIA describes OpenShell as open-source runtime software and Sentry as a reference design for continuous out-of-band monitoring. The practical pattern is broader: place hard limits for network egress, credential use, destructive writes and resource access in systems whose authority is separate from the model and its harness.

For cloud agents, that can mean identity policy, network enforcement and immutable audit paths outside the worker. For coding agents, repository protection and deployment approval should survive a compromised workspace. For physical agents, emergency-stop logic belongs in a safety domain that does not depend on the planning model agreeing to stop.

Test containment as a failure, not a refusal

Acceptance tests should deliberately assume the model ignores an instruction, the harness is manipulated or an allowed tool is used unexpectedly. Measure whether the independent layer sees the boundary crossing, how quickly it acts, what state it preserves and whether the agent can interfere with the response.

NVIDIA's milliseconds claim for Sentry is a vendor performance statement, not a universal target. The operational requirement is simpler: define the maximum damage possible between detection and containment, then engineer the external control to stay inside that budget.

Agent safety is moving from prompt policy toward systems engineering. The release gate should therefore require two answers: what constrains the agent during normal execution, and what still has authority when that first control fails.

Written by the Devence Lab research team.