NVIDIA published a technical post on Sentry, a security framework for AI agents that runs on BlueField-4 DPUs as part of the OpenShell reference architecture announced at GTC Berlin. Sentry puts enforcement in a hardware trust domain separate from the host, and the DPU sits on the node's only path to the model, so host software and the agent cannot alter or disable the controls. Its gateway, DOCA Tower, is built on Envoy and acts as a transparent proxy with TLS termination accelerated in silicon, while DOCA Flow implements a per-agent layer-4 firewall in hardware. Access decisions are evaluated with an Open Policy Agent/Rego policy engine running in memory, which NVIDIA says can decide requests in under a millisecond depending on policy complexity. Runtime context comes from DOCA Argus, which does live memory introspection from the DPU without host-resident agents and maps containers to pods, sandboxes to microVMs, plus processes, file access, loaded libraries and connections. That lets policies require, for example, that a container hash match an allowlist or that the initiating process appear in the software bill of materials. NVIDIA lists the signals it watches for: unapproved tool execution, ptrace abuse, excessive outbound traffic, unauthorized file access, CPU spikes, heavy temp-file writes and mass deletion, any of which can trigger containment. The gateway also governs agent-to-agent and Model Context Protocol traffic and can redact PII and secrets, while locally or remotely hosted classifier models judge whether behavior has drifted from designed intent.
Our takeMoving enforcement off the host is the design choice that matters: guardrails living inside an agent's own runtime can be argued with, edited or escaped, while a DPU on the only path to the model cannot. The value then sits in policy authorship, not the silicon — ptrace calls, outbound volume and temp-file writes are heuristics that will need tuning per workload, and a noisy threshold either blocks real tool use or gets muted. Watch whether outside teams can reproduce sub-millisecond decisions under realistic policy sets.