NVIDIA says Sentry adds hardware-isolated monitoring and enforcement for AI agents using BlueField-4, DOCA Tower and DOCA Argus.

NVIDIA on Wednesday detailed Sentry, a runtime security framework it says is designed to monitor AI agents and enforce access policies from outside the agent and host software. The company described the system as part of its OpenShell reference architecture and said it runs on BlueField-4 DPUs to provide host-isolated protection for agents as they interact with models, tools and data.

In a blog post published Oct. 21, 2026, NVIDIA said Sentry is intended to keep an agent within its defined operational boundaries by placing monitoring and enforcement in a separate hardware trust domain. The framework uses DOCA Tower, an Envoy-based gateway, to inspect agent traffic and DOCA Flow to apply per-agent layer-4 controls in silicon. For inspected connections, DOCA Tower can terminate TLS and evaluate policy through the Open Policy Agent using Rego rules, according to NVIDIA.

The company said DOCA Argus adds independent runtime visibility by analyzing selected regions of host memory from BlueField-4 without host-resident agents. NVIDIA said that gives Sentry real-time context about containers, processes, libraries and system resources, allowing it to correlate access requests with the process, environment and integrity state behind them. The post says this context can be used to apply policies such as verifying container hashes, process hashes, approved execution paths and command-line arguments.

NVIDIA also said Sentry can inspect both requests and responses, including agent-to-agent and Model Context Protocol traffic, and can detect or redact sensitive data such as API keys, tokens and passwords.

Source link