Nvidia's Open Agent Safety Platform: runtime governance for AI agents

What happened

Nvidia has released the Open Agent Safety Platform, a governance system for agentic AI that combines software with out-of-band, DPU-based silicon in a reference system design. The company says the design is meant to secure AI agents from testing through to deployment.

The software layer is built on Nvidia's OpenShell, which Nvidia describes as a secure runtime boundary. According to the company, OpenShell traces the actions agents take and enforces policy while they run on Nvidia Vera CPUs. Because OpenShell is open source, Nvidia says it can be extended to third-party compute platforms, including those from Arm and Intel. The reference design also includes a component called NVIDIA Sentry, which operates out of band, separate from the agent's own execution path.

Nvidia positions the platform as full-stack governance covering software and hardware, including the compute and robotics systems that run agents. InfoWorld's reporting notes that analysts see some cybersecurity benefit in the silicon-based component, but argue it cannot address the large majority of problems that agentic systems raise.

Why it matters

The launch reflects a shift in how organisations think about AI agents. Once software can take actions on its own, such as calling systems, moving data or completing transactions, governance has to operate at runtime rather than sitting in a policy document. Platforms that trace agent actions and enforce policy as they happen give leaders a way to answer the questions that matter most in production: what did the agent do, and was it allowed to do it?

The analyst caveat is the important part for practitioners. A hardware-isolated monitoring layer can strengthen certain security boundaries, but many agent failures originate in logic, permissions, data handling and workflow design, which hardware alone does not reach. For customers and employees who rely on agents, the practical result is that trust will depend on visible, auditable behaviour and clear escalation paths, not on the presence of a specialised chip.

The Renascence take

Most of the coverage will focus on the silicon, but the chip is the least interesting part of this story. The real design question is whether people can see and understand what an agent is doing on their behalf, because people extend trust to systems they can read, not to systems they are told are secure. Operators should start by mapping every agent touchpoint against the failures they actually fear, such as wrong actions, unauthorised data use or silent errors, and only then decide which layer of governance addresses each one. A customer-obsessed operator will treat agent activity logs as a customer-facing feature, with clear explanations and easy routes to a human, rather than leaving them as an internal compliance artefact.