NVIDIA Draws a Security Boundary Below the AI Agent Harness

Where should an AI agent's security boundary live?

NVIDIA's AI safety and security teams published new architecture guidance on August 21, 2026 for securing increasingly autonomous AI agents. The central argument is simple: prompts, model safeguards and agent harness logic can influence what an agent tries to do, but they should not be the authoritative layer that decides what the agent is allowed to do.

The post separates behavioral controls from infrastructure controls. Models and harnesses plan, interpret goals and propose actions. A secure runtime and the surrounding infrastructure should bind those actions to identity, enforce policy, isolate execution, control credentials and preserve an audit trail.

Above proposes; below decides

NVIDIA summarizes the architecture with the principle 'above proposes; below decides.' The model, agent, harness, tools and memory systems sit above the enforcement boundary. They can reason and request actions, but none of them should be able to grant themselves authority.

Below that boundary, the runtime evaluates every effect using approved policy and verified state. NVIDIA points to controls such as least privilege, explicit authorization, isolation, just-in-time access and auditability. The company uses its OpenShell runtime as an example of this layer, while describing products such as Claude Code, Codex, Hermes, Pi and DeepSeek Harness as examples of harnesses above the boundary.

The distinction matters because a harness is intentionally programmable. Plugins, MCP servers, tools and agent logic may change over time. A layer designed to be modified is a weak place to make an unbypassable security guarantee.

Security gaps NVIDIA says teams should watch

The post identifies recurring failure modes in agent systems: unclear boundaries between prompts and enforcement, standing credentials that are broader or longer-lived than needed, untrusted documents or tool output influencing control decisions, APIs that create unintended external effects, cascading failures across subagents, and incomplete audit evidence.

NVIDIA recommends that every state-changing operation cross an enforcement point below the agent boundary. That includes file operations, process creation, network requests, API calls, data changes, resource allocation, communications and device actions.

The guidance also says risk signals should only reduce authority, not increase it. An anomaly score might trigger a tighter policy, but an agent should not gain permissions because it claims a task is safe or because a model-generated confidence score is high.

Four workload security profiles

NVIDIA proposes four security profiles: isolated development, connected pre-production, production and adversarial/red-team operation. Controls become stricter as authority and impact increase. Production workloads call for task-scoped access and independent checks, while adversarial agent runs should default to stronger isolation and communication restrictions.

The post also argues that high-impact production actions may need human approval even when the rest of the workflow is automated. This is not a new cryptographic primitive or formal security standard; it is a practical architecture model for deciding which part of an agent stack should have final authority.

Why this guidance matters

As agents gain tool access, code execution and long-running memory, security can no longer rely only on model alignment or instructions. The surrounding system needs controls that remain effective even when the model is mistaken, compromised or unusually capable.

For developers building production agents, the most useful design lesson is to treat the harness as untrusted from the perspective of authorization. Let the agent propose actions, but enforce the final decision in a runtime layer the agent cannot rewrite or bypass.