Agent containment needs a tested failure path, not a layered architecture label

NVIDIA announced an Open Agent Safety platform on 28 September. Its reference architecture combines OpenShell, a runtime boundary intended to apply policy and trace agent actions, with Sentry, an out-of-band watchdog running on BlueField-4 infrastructure. NVIDIA says Sentry can monitor independently of the host and quarantine a system within milliseconds when compromise is detected.

The design addresses an important problem: a powerful agent may use tools, credentials and network paths faster than an operator can inspect individual actions. A separate monitor can preserve observation when the host is impaired. But product topology is not evidence that the complete safety path works for a buyer's workload, threat model or recovery obligations.

Name the failure path

Draw the path from an agent action to telemetry, policy evaluation, alert, isolation, credential revocation, queued-action cancellation and restoration. For every step, identify the component, authority and deadline. Ask what happens when the host lies, telemetry is delayed, the policy service is unavailable, the watchdog loses connectivity or an attacker targets the monitor itself.

NVIDIA's technical explanation describes kernel isolation and continuous in-silicon monitoring. Those properties may reduce dependence on the application layer. They do not remove dependencies on configuration, identity, policy distribution, network design or the correctness of detection logic. The reference system should therefore be treated as a candidate control set, not a pre-certified outcome.

Exercise layers separately and together

Start with benign policy violations, then run tool misuse, credential theft, prompt injection, data exfiltration and host-compromise scenarios. Deliberately disable or delay one layer. Measure whether another layer detects the action, how much unauthorised work completes, whether isolation contains derived sessions and how long safe restoration takes. Repeat after policy, model, tool and infrastructure updates.

False positives matter. An aggressive watchdog that repeatedly quarantines valid work can cause teams to bypass it or widen policy until the control becomes decorative. Track precision, missed detections, operational disruption, operator response and exceptions. Require every exception to expire and retain the evidence that justified it.

Independent reporting by Associated Press noted the ambition of the platform and expert caution that significant agent-security challenges remain. That is the right posture: a hardware-separated observer changes the defensive options, but does not establish the coverage of novel attacks or the absence of unsafe authorised actions.

The counterargument is that no security product can prove protection against every attack. Correct. The gate should not demand perfection. It should demand a bounded claim: named scenarios, known exclusions, measured containment time, recovery evidence and ownership for residual risk. Procurement comparisons should use the same scenario pack rather than feature counts or the word “layered”.

Connect security evidence to operating authority. A safer agent is not one with a prominent monitor; it is one whose tools, identities, spending limits and data access can be reduced quickly, whose queued actions can be cancelled, and whose decisions can be reconstructed. The Skills Intelligence glossary can align terms, while the exercised failure path shows whether the control works.

Include recovery ownership in the service design. A security team may initiate quarantine, but application owners must know how to preserve evidence, serve users safely and validate restored state. The exercise should test handoffs, not merely the speed of the first automated action, and it should fail if restoration silently reuses compromised credentials. Record the validated restoration point and the operator who accepted it.

The immediate decision is to make a cross-layer containment exercise a deployment gate. Run it on the real toolchain, record the longest unauthorised action window and restoration time, and refuse broader authority until the team can demonstrate detection, isolation, revocation and recovery when one layer is unavailable.