Nvidia published a reference architecture for running autonomous agents under infrastructure-level governance, built on OpenShell, an open-source runtime it describes as treating every agent workload as untrusted. The argument is that agents work for hours, download code, build tools and request privileges, so the action path cannot be known in advance and the agent cannot police itself. OpenShell has four parts: a gateway that manages sandbox lifecycles and policies; a supervisor that checks outbound requests against policy and mediates credentials while running outside the sandbox; a sandbox that isolates the workload and restricts filesystem and process access; and a policy prover that formally checks whether a policy's permissions stay within an organisation-defined ceiling. Supervisor middleware can inspect, block or rewrite traffic, and gateway interceptors add deployment-specific governance without modifying the control plane. Nvidia positions the control plane on Vera CPUs, arguing that agent loops stress core count, per-core speed, memory and fabric bandwidth, I/O, and hardware-enforced isolation.
Our takePutting enforcement outside the agent is the right boundary: a supervisor that mediates credentials and a sandbox that restricts filesystem access cannot be talked out of a decision. The limits sit in the policy layer. A prover can show that permissions stay under a ceiling, not that the ceiling was chosen well, and middleware inspection of outbound traffic adds latency to every tool call. The design is a useful pattern, but adoption will hinge on how painful policy authoring turns out to be.