NVIDIA details Sentry, its hardware-isolated agent monitor
NVIDIA has explained how Sentry, part of its OpenShell agent reference architecture, runs on BlueField-4 DPUs to monitor AI agents and enforce access policies from outside the host, where a compromised agent can't reach it.
NVIDIA has published a technical deep-dive on Sentry, a security software framework built on DOCA that runs on BlueField-4 DPUs. Sentry belongs to the OpenShell reference architecture announced at GTC Berlin, which we covered in our reports on NVIDIA's open agent safety stack and the OpenShell 0.1.0 runtime.
NVIDIA's argument is that an agent can finish its task and still break a security boundary, so monitoring has to sit where the agent can't change or switch it off. OpenShell already keeps policy enforcement separate from the agent in software. Sentry adds a hardware layer on top of that. Agents run on Vera CPUs, and BlueField-4 sits on the node's only path to the model and to the outside world.
The post describes three main parts:
- DOCA Flow runs a layer-4 firewall for each agent, accelerated in silicon. It blocks unauthorized destinations and passes permitted traffic on to DOCA Tower.
- DOCA Tower is an AI security gateway built on Envoy. It works as a transparent proxy, decrypts TLS in hardware for connections configured for inspection, and does layer-7 inspection. It checks requests against Open Policy Agent (OPA) rules written in Rego, which NVIDIA says can be evaluated in under a millisecond depending on policy complexity. It also works with OpenShell policies.
- DOCA Argus inspects host memory directly from the DPU, with no software agent on the host. It maps containers, microVMs, processes, libraries and network connections, tracks them by hash, and gives Sentry that context when it judges each access request.
The excerpt doesn't cover pricing, availability or performance overhead.