NVIDIA details Sentry runtime security for AI agents

NVIDIA on Wednesday detailed Sentry, a runtime security framework it says is designed to monitor AI agents and enforce access policies from outside the agent and host software. The company described the system as part of its OpenShell reference architecture and said it runs on BlueField-4 DPUs to provide host-isolated protection for agents as they interact with models, tools and data.

Evidence and context

In a blog post published Oct. 21, 2026, NVIDIA said Sentry is intended to keep an agent within its defined operational boundaries by placing monitoring and enforcement in a separate hardware trust domain. The framework uses DOCA Tower, an Envoy-based gateway, to inspect agent traffic and DOCA Flow to apply per-agent layer-4 controls in silicon. For inspected connections, DOCA Tower can terminate TLS and evaluate policy through the Open Policy Agent using Rego rules, according to NVIDIA.

The company said DOCA Argus adds independent runtime visibility by analyzing selected regions of host memory from BlueField-4 without host-resident agents. NVIDIA said that gives Sentry real-time context about containers, processes, libraries and system resources, allowing it to correlate access requests with the process, environment and integrity state behind them. The post says this context can be used to apply policies such as verifying container hashes, process hashes, approved execution paths and command-line arguments.

NVIDIA also said Sentry can inspect both requests and responses, including agent-to-agent and Model Context Protocol traffic, and can detect or redact sensitive data such as API keys, tokens and passwords. The post says the system can capture tamper-evident records of communications and policy decisions, and can feed telemetry into enterprise security systems such as SIEM and XDR platforms. NVIDIA described this as a way to preserve evidence even if an agent alters logs in its own environment.

What NVIDIA says the system does

According to the company, Sentry combines network inspection, runtime evidence and identity context to judge whether an agent is acting within its intended permissions. It said the framework integrates with SPIFFE/SPIRE for workload identity and can incorporate partner identity systems. The post also said specialized AI models can classify agent behavior using tool calls and reasoning traces, either inline or out of band, to identify behavioral drift or potentially harmful activity.

NVIDIA listed several warning signs Sentry is designed to flag, including unapproved tools, ptrace-based attacks, excessive outbound traffic, unauthorized file access, CPU spikes, excessive writes to temporary folders and large-scale file deletion. The company said that when deviations are detected, Sentry can request millisecond-scale containment using BlueField-4 enforcement capabilities. That timing is a vendor claim and was not independently verified in the material supplied.

Rollout and limitations

The post said developers and cybersecurity teams can begin experimenting with the underlying DOCA libraries and microservices, including DOCA Argus, DOCA Flow and OVS-DOCA, ahead of Sentry’s planned availability early next year. NVIDIA also said it plans to publish core plugins, including one that exposes agent communications for further analysis, which means those plugins should not be treated as already released.

Separately, background material supplied with the announcement says NVIDIA introduced Sentry within its Open Agent Safety Platform on Sept. 28, 2026, and that the Oct. 21 architecture update pairs Sentry with OpenShell, Vera CPUs and BlueField-4. The same background notes that Sentry is built on NVIDIA DOCA and runs on BlueField-4 DPUs, but the supplied material does not provide independent verification of performance claims or deployment scale.