AI agents need an independent security layer

AI agents are gaining access to code, credentials, applications, data, and infrastructure.

Their security controls must remain outside their reach.

NVIDIA has introduced its Open Agent Safety Platform, a reference architecture for continuous monitoring and policy enforcement across software and hardware.

The platform combines:

• OpenShell, an open-source runtime running agents inside isolated sandboxes
• Verifiable policies defining permitted files, networks, tools, processes, and credentials
• NVIDIA Sentry, an independent monitoring and enforcement layer operating on BlueField-4 DPUs
• Continuous records linking agent activity with policy decisions, tool use, data access, and identity

In NVIDIA Vera Rubin POD systems, BlueField-4 sits on the path between the agent and the model. This position supports out-of-band visibility and real-time enforcement from hardware beyond the agent’s control.

The broader security principle matters more than the individual architecture.

An AI agent should never serve as its own security boundary.

Agents sometimes drift from their intended task because of ambiguous instructions, missing tools, software defects, policy blocks, or long-running autonomous execution.

A capable agent might also write code, launch processes, delegate work, access external services, or request broader permissions.

Security must remain enforceable even when the agent behaves unexpectedly.

NVIDIA’s architecture reflects five important principles:

• Verify policy before execution
• Enforce controls outside the agent workload
• Monitor the agent’s path to the model
• Increase visibility as agent authority expands
• Divide responsibility across model providers, enterprises, and infrastructure vendors

This moves agent security beyond prompt-level safeguards.

Model alignment remains important. Yet production environments also need technical boundaries enforced independently across identity, runtime, network, data, and infrastructure.

My takeawayAI agents need the same security principle applied to every privileged system.

Never allow the protected workload to control, disable, or bypass its own security enforcement.

Is your agent security embedded inside the agent, or independently enforced around it?