---
title: "Add Runtime Controls to AI Agents with NVIDIA OpenShell"
description: "AI agents with broad access to systems and data can cause failures like modifying production data or exposing secrets. NVIDIA OpenShell 0.1.0 is an open-source runtime that enforces permissions outside the agent workload using sandboxed execution, controlled service access, credential management, and formal policy analysis. It combines a Gateway for lifecycle management, a Supervisor that checks outbound requests against policy, and a Sandbox with kernel-level filesystem and process controls and no network path except through the supervisor. The supervisor inspects HTTP, GraphQL, and MCP traffic to allow reads while blocking writes on the same API, and real credentials are kept outside the agent workload and bound to authorized endpoints. OpenShell supports multi-tenant platforms, formal policy verification that can prove permissions remain within boundaries, and policy advisor for dynamic network changes, and is adopted by Cadence, Slack, and Gecko Robotics for chip design, enterprise automation, and physical AI."
---

# Add Runtime Controls to AI Agents with NVIDIA OpenShell

[NVIDIA](https://yomu.fyi/company/nvidia-developer-blog) · Alex Watson · Sep 28, 2026

**Type:** Announcement

## Summary

AI agents with broad access to systems and data can cause failures like modifying production data or exposing secrets. NVIDIA OpenShell 0.1.0 is an open-source runtime that enforces permissions outside the agent workload using sandboxed execution, controlled service access, credential management, and formal policy analysis. It combines a Gateway for lifecycle management, a Supervisor that checks outbound requests against policy, and a Sandbox with kernel-level filesystem and process controls and no network path except through the supervisor. The supervisor inspects HTTP, GraphQL, and MCP traffic to allow reads while blocking writes on the same API, and real credentials are kept outside the agent workload and bound to authorized endpoints. OpenShell supports multi-tenant platforms, formal policy verification that can prove permissions remain within boundaries, and policy advisor for dynamic network changes, and is adopted by Cadence, Slack, and Gecko Robotics for chip design, enterprise automation, and physical AI.

## Context

AI agents with broad access to systems and data can cause failures like modifying production data or exposing secrets. OpenShell provides a runtime layer to enforce permissions outside the agent workload, combining sandboxed execution, controlled service access, credential management, and formal policy analysis.

## Approach / What changed

OpenShell uses a Gateway for lifecycle management, a Supervisor that checks outbound requests against policy, and a Sandbox with kernel-level filesystem and process controls. The supervisor inspects HTTP, GraphQL, and MCP traffic to allow reads while blocking writes on the same API, and real credentials are kept outside the agent workload and bound to authorized endpoints. Policies are authored in YAML and compiled to OPA/Rego.

## Takeaways

- OpenShell enforces permissions outside the agent workload using a sandbox with kernel-level filesystem and process controls and a supervisor that inspects outbound requests against policy.
- The supervisor can inspect HTTP, GraphQL, and MCP traffic to allow reads while blocking writes on the same API, and real credentials are kept outside the agent workload and bound to authorized endpoints.
- OpenShell includes a formal policy prover that can prove permissions remain within boundaries, and a policy advisor for dynamic network changes that require human approval.

## FAQ

### How does OpenShell prevent an agent from accessing unauthorized services?

OpenShell uses a supervisor that checks each outbound request against a policy. The sandbox has no network path except through the supervisor, which inspects HTTP, GraphQL, and MCP traffic and can allow reads while blocking writes on the same API.

### How are credentials protected from the agent?

Real credentials are kept outside the agent workload. The agent uses a placeholder, and OpenShell substitutes the real credential only for authorized endpoints. If the agent sends the placeholder to an unauthorized destination, OpenShell rejects the request.

### Can an agent request additional permissions while running?

Yes, with policy advisor enabled, the agent can propose a narrowly scoped network or file policy change. The proposal remains pending for human review by default, and the agent cannot approve its own request. After approval, OpenShell loads the new rule into the running sandbox without restarting.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [NVIDIA](https://yomu.fyi/topic/nvidia), [Open Source](https://yomu.fyi/topic/open-source), [Sandboxing](https://yomu.fyi/topic/sandboxing), [Security](https://yomu.fyi/topic/security)

- Source: [NVIDIA](https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell)
- Source URL: https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell
- Ingested by Yomu: 2026-09-28T09:00:12.588Z

[Read original post](https://developer.nvidia.com/blog/add-runtime-controls-to-ai-agents-with-nvidia-openshell)