NVIDIA has published a reference architecture combining the OpenShell runtime with NVIDIA Vera CPUs, and optionally BlueField-4 DPUs with NVIDIA Sentry, to support governed, high-performance execution of autonomous agents. OpenShell enforces what agents may access via gateway, supervisor, sandbox and policy-prover components, while Vera provides core count, memory bandwidth and I/O tuned for dense agent workloads.
Why this matters
Autonomous agents can run for hours, access files, tools and the internet, and spawn other agents. Because their action paths evolve as they reason and interact with systems, they can request privileges, download code and touch more infrastructure over time — increasing security risk. Agents don’t self-govern; governance and security must live in the infrastructure around them.
OpenShell: deterministic governance outside the agent
NVIDIA OpenShell is an open-source runtime that builds required security and governance into compute infrastructure. It defines and enforces which systems and data an agent may reach, from files and internet services to systems interfacing with physical devices. OpenShell treats agent workloads as untrusted for the duration of execution and grants access only when and as needed.
OpenShell’s four main components are:
- Gateway: the control plane that manages sandbox lifecycles and policies.
- Supervisor: evaluates outbound requests against policy and mediates credential access; it runs completely separate from the sandbox.
- Sandbox: isolates the agent workload and restricts filesystem and process access.
- Policy prover: adds formal verification to check that policy permissions stay within organization-defined ceilings.
These components provide the infrastructure controls that let evolving agents operate safely.
Extending and integrating OpenShell
Extensibility is central to OpenShell. Supervisor middleware can inspect, block or modify network content as an additional enforcement layer. Gateway interceptors let operators add deployment-specific governance to control-plane operations without altering the gateway itself.
Identity, authorization, data protection and auditing are all required to define whom an agent acts for and what authority it holds; OpenShell provides enforcement points where those systems can be integrated.
Vera: the compute layer under the controls
OpenShell defines what agents can do; NVIDIA Vera CPUs determine how quickly they can do it. Agent workloads run dependent loops — reasoning, calling tools, executing code, querying data — where each step must complete before the next begins. AI-factory scale runs thousands of these loops concurrently and imposes five demands on CPU architecture:
- many cores to run concurrent workflows and fast single cores to shorten sequential steps;
- high-bandwidth fabric and memory to feed those cores with live data;
- massive I/O to move data between CPUs, GPUs, storage and network;
- hardware-enforced security to isolate sensitive enterprise data;
- energy-efficient operation to increase agent work per watt.
NVIDIA describes this combination as the "max single-threaded CPU at scale," and Vera is built for it: 88 NVIDIA-designed Olympus cores, a second-generation Scalable Coherency Fabric, LPDDR5X memory, PCIe Gen 6 I/O, confidential computing features, and an energy-efficient design for power-limited data centers.
Three architecture features that speed agent workloads
- Core performance: 88 Olympus cores with a 10-wide front end, neural branch predictor and deep out-of-order execution, delivering up to 2× performance on critical agentic workloads versus x86 for shorter tool calls, code execution and evaluation.
- Core-to-core connectivity: Vera’s second-generation Scalable Coherency Fabric provides up to 3× core-to-core bandwidth and up to 50% lower core-to-core latency than x86 alternatives. Vera also integrates 96 lanes of PCIe Gen 6 for the I/O bandwidth agentic infrastructure requires.
- Memory bandwidth and efficiency: LPDDR5X delivers up to 1.2 TB/s memory bandwidth with up to 40% lower loaded memory latency than chiplet-based designs, keeping agents supplied with live context. LPDDR5X also improves energy efficiency: Vera claims 2× more performance per watt than x86 CPUs, while the LPDDR5X subsystem draws an order of magnitude less power than DDR5-based configurations.
Faster, denser sandboxes
Agents must run in isolated sandboxes to execute code, call tools and complete tasks without interfering with each other or the host. Faster sandbox startup and higher density increase the amount of agent work a given infrastructure can sustain.
CoreWeave measured sandbox startup on Vera to be more than 3× faster than on x86, with a single rack supporting more than 11,000 concurrent agent environments. Running Terminal Bench (which measures CPU performance across real agentic loop tasks) CoreWeave found Vera delivered 1.8× faster performance versus x86 across tasks ranging from scripting to database recovery. That density and under-load performance reflect the requirements of agent infrastructure.
Hardware-enforced protection: NVIDIA BlueField and NVIDIA Sentry
OpenShell places authority outside the agent; for deployments requiring more protection, that separation can extend into purpose-built silicon. NVIDIA BlueField-4 DPUs provide a hardware-isolated trust domain outside the agent’s reach. In the OpenShell reference architecture, BlueField-4 sits in the I/O path between agents on Vera and the models they access.
NVIDIA Sentry, a security software framework built on NVIDIA DOCA, runs in that independent domain to continuously monitor agent behavior and enforce runtime policy. NVIDIA Sentry observes requests and responses, networking and file activities, verifies identity and delegated authority, and analyzes selected host memory to detect deviations from authorized behavior without relying on agent self-reporting. When it detects a threat or policy violation, BlueField-4 can enforce policy in silicon and quarantine the agent within milliseconds.
Putting it together for scale
Running agents in production requires infrastructure that keeps thousands of workflows moving while governing every action. Vera supplies compute, memory bandwidth and I/O to sustain those workflows. OpenShell supplies the runtime boundaries that determine which actions execute and which resources agents can reach. For additional protection, NVIDIA Sentry on BlueField-4 adds independent monitoring and in-silicon enforcement.
The NVIDIA Vera Rubin platform (where LLMs run), together with OpenShell and NVIDIA Sentry on BlueField-4, form the pillars of the OpenShell reference architecture, producing a complete, hardware-rooted stack for safe AI agents: performance to make agents productive and controls to keep their work within authorized boundaries.
Getting started
To implement secure agent governance, organizations can begin with NVIDIA OpenShell, consult the documentation, and evaluate how NVIDIA Vera CPUs accelerate agent workloads.
