NVIDIA Maps Where Security Should Live in an AI Agent Stack

NVIDIA's security boundary for AI agents

NVIDIA's AI safety and security teams published a practical architecture for securing increasingly capable AI agents. The central distinction is between behavioral controls, which guide what an agent is likely to attempt, and infrastructure controls, which determine what the agent is actually authorized to do. Prompts, model safeguards and harness logic remain useful, but NVIDIA argues they should not be treated as the final security boundary because those layers are designed to interpret, adapt and, in some systems, modify behavior.

Runtime and infrastructure become authoritative

The proposed stack separates products and orchestration from agent harnesses, secure runtimes and inference infrastructure. NVIDIA uses OpenShell as an example of a secure runtime responsible for isolation, identity, policy, credentials and audit. The design principle is that models and harnesses can propose actions, but an enforcement layer below them must make the authorization decision. This matters for files, processes, network calls, APIs, data operations, resource allocation and other actions that can change external state.

Five design rules

NVIDIA highlights several durable systems-security ideas for agent deployments: keep authority outside the agent, place authoritative policy below the model and harness boundary, check every meaningful external effect, issue narrow and short-lived access, and design for isolation, revocation and recovery. The article also recommends treating components above the boundary as potentially mistaken or compromised rather than granting trust merely because they are part of the agent framework.

Security should scale with agent risk

The framework describes progressively stronger controls for isolated development, connected pre-production work, production activity and adversarial or red-team settings. Higher-impact workloads call for narrower permissions, fresher authorization decisions, stronger supervision, faster rollback or quarantine, and independent audit evidence. For teams deploying coding agents, browser agents or autonomous operational systems, the practical takeaway is to avoid making the same programmable harness both the actor and the final security authority.

This is an architectural recommendation from NVIDIA rather than a universal standard. Teams should still threat-model their own effect paths, identity systems, credentials, data boundaries and recovery requirements before granting agents production access.