Inside NVIDIA Sentry: Secure AI Agents at Runtime | NVIDIA Technical Blog

This post details the technical implementation of NVIDIA Sentry, a security framework for AI agents running on BlueField-4 DPUs. It introduces DOCA Tower as a transparent proxy leveraging Envoy for TLS termination and Layer-7 inspection, integrated with Open Policy Agent (OPA) for policy evaluation in under a millisecond. DOCA Argus is presented as a host-independent memory introspection tool for runtime context gathering, mapping containers, processes, and their properties. The system correlates network traffic with runtime context (e.g., container hashes, process integrity, SBOM) to enforce granular access policies, with in-silicon enforcement for rapid threat containment.