OpenShell places agent permissions outside the agent’s own process
NVIDIA’s OpenShell architecture separates an agent’s sandbox from the supervisor that checks outbound requests and supplies credentials. A gateway manages policies and sandbox lifecycles, while a policy prover checks permissions against an organization’s ceiling. This makes access control part of the surrounding runtime instead of relying on model instructions. The open-source runtime and the article’s specialized hardware reference architecture are distinct deployment choices.
NVIDIA · Oct 21, 2026
Why it matters
A useful agent needs tools, but the authority to use them should remain enforceable outside its reasoning loop.
More context
Try an isolated demonstration before real credentials. The repository lists Linux, Apple-silicon macOS and experimental WSL 2 support, with Docker, Podman or host virtualization. Its default sandbox is minimal Ubuntu without an agent; Kubernetes deployments require a CNI that enforces NetworkPolicy.
Keep in mind
The 0.1-series runtime still needs deployment-specific policy and integration review. Formal policy checks do not prove that every permitted action is harmless, and hardware benchmark claims are not general guarantees.
Original read