Add Runtime Controls to AI Agents with NVIDIA OpenShell | NVIDIA Technical Blog

Introduces NVIDIA OpenShell 0.1.0, an open-source runtime that enforces access controls for AI agents without requiring agent code modification. Key contributions include: 1. Sandboxed execution with kernel-level filesystem and process controls. 2. Controlled service access via a supervisor that inspects outbound requests (HTTP, GraphQL, MCP) against defined policies, allowing read-only access while blocking writes. 3. Credential management, where real credentials are kept outside the agent workload and substituted only for authorized requests. 4. Formal policy verification using OPA/Rego to ensure permissions stay within defined boundaries. Demonstrates policy enforcement with a curl example against the GitHub API, showing how network access and specific API operations can be restricted. OpenShell components (Gateway, Supervisor, Sandbox) are detailed, along with multi-tenant platform support and integration with third-party security services.