NVIDIA has introduced NVIDIA Sentry, a hardware-isolated security framework that monitors AI agents and enforces policies governing their access to models, tools, and data. Sentry is part of the NVIDIA OpenShell reference architecture, built on NVIDIA DOCA and designed to run on NVIDIA BlueField-4 DPUs, providing host-isolated runtime protection so agents operate within intended boundaries even when host resources are untrusted.
Independent security layer for agent runtime protection
Sentry operates from a separate hardware trust domain on BlueField-4, which sits on the node’s only path to the model and the outside network. This enables Sentry to inspect agent-to-model communications and enforce access policies independently of host software. The approach complements NVIDIA OpenShell, which separates policy enforcement from the agent workload; Sentry provides an out-of-band, hardware-level safeguard beyond the agent’s reach.
Agents execute on NVIDIA Vera CPUs in the OpenShell reference architecture, while BlueField-4 mediates access to models and the network. In addition to network inspection, Sentry uses memory introspection to add context about an agent’s execution environment (for example, a container or microVM), helping detect external threats and agent misbehavior.
Governing agent communications: DOCA Tower and DOCA Flow
DOCA Tower is Sentry’s AI security gateway. Built on Envoy, it acts as a transparent proxy between agents and the external environment. Agent network traffic reaches BlueField-4 via a direct network I/O path that bypasses host OS/hypervisor packet processing, allowing Sentry to govern all agent communications.
DOCA Flow implements a layer-4 firewall for each agent, accelerated in silicon on BlueField-4. Unauthorized connections are blocked at layer 4; permitted traffic is forwarded to DOCA Tower for layer-7 inspection, authorization, and further security checks. DOCA Tower performs TLS termination using in-silicon TLS acceleration and decrypts traffic configured for inspection.
To evaluate access requests, NVIDIA Sentry uses Open Policy Agent (OPA). OPA uses the Rego language and runs locally in memory; depending on policy complexity and configuration, it can evaluate requests in under a millisecond. DOCA Tower is compatible with OpenShell policies, extending network access and runtime controls into BlueField-4.
Runtime context from DOCA Argus
Network data alone is insufficient to fully assess an agent’s security or integrity. DOCA Argus supplies real-time visibility into an agent’s execution environment and operational state through live memory introspection. It analyzes selected regions of volatile host memory from BlueField-4 without relying on host-resident agents, providing independent evidence even if the host is compromised.
DOCA Argus maps containers to pods, sandboxes to microVMs, identifies running processes and their properties, and tracks relationships between processes and threads, file access, network connections, loaded libraries, CPUs, GPUs and memory. It follows containers, processes and loaded libraries using associated hashes. This runtime context enables Sentry to link access requests to the processes and execution environments that initiated them, and to enforce policies that consider both the requested action and the agent’s runtime integrity.
Evaluating access requests with runtime context
NVIDIA Sentry correlates network connection information from DOCA Tower with runtime context from DOCA Argus when evaluating access requests. For example, a policy may require that a container hash matches an approved list, that the initiating process appears in the container SBOM, that the process is permitted to initiate network connections, and that it uses an approved execution path and command-line arguments. DOCA Tower’s policy engine performs this correlation and checks if the requested access (for example, calling an API or performing a specific action) is permitted.
DOCA Argus also supplies real-time alerts and observations for behavior that may indicate compromise or misuse: running unapproved tools; using ptrace to attack or spawn attacking processes; excessive outbound traffic suggesting data leakage; unauthorized file access or modifications; CPU spikes; excessive temporary-file writes; and large-scale file deletion. On detecting deviations, Sentry can request in-silicon containment at millisecond timescales.
Controls for requests and responses
Sentry inspects both outbound requests and inbound responses because responses can deliver malicious instructions or content that redirect an agent. DOCA Tower’s inspection capabilities allow Sentry to:
- Apply IP-, URL- and protocol-level restrictions;
- Capture tamper-evident records of requests, responses and data flows for behavioral analysis and investigation;
- Govern agent-to-agent (A2A) and Model Context Protocol (MCP) traffic;
- Detect and redact personally identifiable information and secrets (API keys, tokens, passwords);
- Identify and block content prohibited by policy.
Policies are applied continuously over an agent’s session as it accesses models, tools, APIs and services.
Behavior classification with specialized models
NVIDIA Sentry integrates with specialized AI classifiers that analyze agent communications and tool calls, using available reasoning traces to classify behavior. These models can run locally or remotely on GPU-accelerated systems and operate inline (blocking harmful content before delivery) or out of band (triggering response actions after detection). Tamper-evident activity records and detection results provide forensic evidence for incident investigations.
DOCA Argus augments classification with ongoing analysis of the agent’s operational environment to evaluate runtime security and detect behavioral drift.
Fast containment and enterprise integration
Using BlueField-4’s in-silicon enforcement, Sentry can contain and quarantine agents in milliseconds without cooperation from the agent or the host software. This independent enforcement capability is critical if software boundaries fail and an agent escapes its sandbox: Sentry retains monitoring and enforcement because it operates from BlueField-4’s isolated trust domain.
Sentry produces attested telemetry and tamper-evident records on BlueField-4: DOCA Tower logs inspected communications and policy decisions outside the reach of the agent and host software, and DOCA Argus contributes independent runtime signals. Security teams can use these records to reconstruct interactions, review enforcement actions, and support audits. NVIDIA Sentry can forward telemetry to enterprise security platforms such as XDR and SIEM systems and security data lakes.
Identity-aware access decisions
Sentry ties agent identity to permissions and requested actions. DOCA Tower integrates with SPIFFE/SPIRE to support verifiable workload identity and can work with partner identity systems. Identity establishes who issued a request, authorization policies determine which resources that identity may access, and runtime evidence adds context about the execution environment associated with the request. If an agent’s integrity or behavior changes, Sentry uses that context for subsequent access evaluations.
Extensibility and ecosystem
Developers and cybersecurity providers can extend monitoring, governance and enforcement through DOCA libraries and microservices. DOCA Tower leverages Envoy’s extensibility, allowing partners to adapt existing plugins or build new ones to run on BlueField. NVIDIA plans to publish core plugins to accelerate development, including a plugin that exposes agent communications for analysis of reasoning traces.
Partners may combine Sentry capabilities with identity services, AI classifiers, threat intelligence, and security operations platforms: Sentry delivers independent runtime visibility and infrastructure enforcement, while connected platforms provide enterprise context and coordinate investigation and response.
Availability and how to get started
NVIDIA recommends developers and security teams begin experimenting with NVIDIA DOCA. Available libraries and microservices—such as DOCA Argus, DOCA Flow and OVS-DOCA—offer a starting point for out-of-band observability and infrastructure enforcement ahead of NVIDIA Sentry’s planned availability early next year.
Why this matters
As agentic AI scales, continuous visibility and control over what agents can access and do during execution become essential. NVIDIA Sentry extends protection from software execution boundaries into a hardware-isolated safeguard, enabling organizations to evaluate agent identity, authority, interactions and runtime integrity together and to take action when behavior crosses defined boundaries.
