Loading…
How to Govern Autonomous Agents in Enterprise AI Factories
NVIDIA Developer BlogMichelle Horton
Summary
Autonomous AI agents require governed environments to safely inspect code, execute tests, query enterprise systems, and handle sensitive business data. The NVIDIA Secure Agent Workspace Reference Design shifts agent execution away from user laptops to dedicated, single-user virtual machines managed on Red Hat OpenShift Virtualization or Microsoft Azure. Perimeter defenses enforce enterprise single sign-on access broker connections, default-deny network egress rules, and human approval gates for critical state-changing actions. Inside the workspace virtual machine, active sandboxing through NVIDIA OpenShell evaluates signed security policies before each tool invocation while credential proxies prevent direct access to raw secrets. GitOps workflows continuously reconcile infrastructure profiles and network configurations while all operational and security telemetry streams to centralized SIEM platforms in OCSF format.
Context
Autonomous AI agents that inspect code, run tests, query internal systems, and operate for extended periods can access sensitive enterprise data and take actions across business systems, creating security risks if run on unmanaged local user endpoints.
Approach / What changed
The NVIDIA Secure Agent Workspace Reference Design isolates agent execution inside dedicated single-user virtual machines on Red Hat OpenShift Virtualization or Microsoft Azure, treating user endpoints as presentation layers. The architecture enforces perimeter security with SSO and default-deny egress, adds runtime sandboxing with signed policies and credential proxies via runtimes like NVIDIA OpenShell, and integrates human approval gates and OCSF logging.
Takeaways
- Agent execution is isolated within dedicated single-user virtual machines on Red Hat OpenShift Virtualization or Microsoft Azure, treating user endpoints solely as presentation surfaces.
- Runtime security inside the virtual machine uses dedicated runtimes like NVIDIA OpenShell, signed security policy bundles, and credential proxies to prevent agents from accessing raw secrets.
- System-altering actions require mandatory human review gates, and all workspace and runtime tool telemetry is exported to centralized SIEM systems using the OCSF format.
Related reading
Hardware-Rooted AI Security That Won’t Slow You Down
NVIDIA Confidential Computing secures enterprise data, proprietary model weights, and the model itself during active AI inference. The architecture integrates silicon-level private signing keys fused during manufacturing, encrypted multi-GPU NVLink, and remote attestation through the NVIDIA Remote Attestation Service alongside CPU Trusted Execution Environments. To mitigate overhead from secure work submission latency and encrypted host-to-device transfers, software optimizations incorporate CC-safe autotuner timing in FlashInfer, asynchronous copy workers in SGLang, and piecewise CUDA graph replay. Benchmarks on an HGX B300 system running the Qwen 3.5 397B-A17B model at FP8 precision show inference performance reaches up to 98% of non-confidential baselines across tested concurrency levels.
Elizabeth GoodmanBuilding Faster Cryptography with Carryless Multiplication in NVIDIA CUDA 13.3