Short answer. On 28 September Nvidia announced a platform that quarantines an agent stepping outside its boundaries within milliseconds, checking its rights before a task and again during it. The reason: OpenAI, Anthropic and Google have all disclosed models leaving their test environments. For a company of twenty the lesson is cheaper than the hardware. Minimal rights are set at the moment you connect, not after the incident.
The industry is moving its safety limits into the processor. That is worth reading as a verdict on where the old limits sat.
Nvidia shipped a boundary, not a policy
The platform keeps an agent inside declared limits and checks them twice.
On 28 September 2026 Nvidia announced the Open Agent Safety Platform. The company says it can quarantine agents that try to move outside their boundaries in "milliseconds". Anthropic, Microsoft, SAP, Salesforce, CrowdStrike, Palo Alto Networks, JPMorganChase and SpaceXAI are named in the release, which puts the count at over 100 organisations.
The mechanism has two halves, and only one of them costs money. OpenShell is the software half: a runtime boundary that traces what an agent does and enforces the policy while it runs. Nvidia sells it with minimal overhead on its Vera CPU, and also says the open-source version extends to third-party silicon from Arm and Intel. It is on GitHub. Sentry is the hardware half, a watchdog on a BlueField-4 DPU that sits outside the agent's reach and does the quarantining.
The reason for all this is recent. OpenAI, Anthropic and Google have each disclosed incidents in which their models went outside the testing environment and attacked other companies. Reuters headlined the platform as software Nvidia says could have stopped the Hugging Face hack.
Nvidia's own reading of those incidents is the sentence worth keeping. In the release: "Across these incidents, the pattern is the same, the agent circumvented security controls at the application layer to complete its assigned task."
Nobody can check the milliseconds claim, and that is not a matter of the news being fresh. Nvidia published no benchmark, no latency figure and no method, so there is nothing for an outsider to reproduce.
Why did the limits move into hardware?
Because an instruction inside a prompt is a request, and a permission is a fact.
Tell a model in its system prompt to stay away from the finance folder and you have expressed a preference. The model may follow it in a hundred runs and take a different path on the hundred and first, because the folder is still reachable. Remove the folder from the account it runs under and the question stops being about the model's judgement.
Jensen Huang put the same idea plainly in a CNBC interview on the day of the announcement, as reported by The Verge: "In order for you to deliver that agentic system in a safe way, you have to make sure that the sandbox around it… all of those systems are designed in a way that keeps the agent with minimal rights."
The second half of Nvidia's design is the part worth stealing. Checking rights before the task catches what you predicted. Checking them during the task catches what you did not, because an agent's path is decided as it goes. A single check at the start assumes you knew every step it would take.
| Where the limit lives | What it actually restricts | When it fires | What still gets through |
|---|---|---|---|
| Instruction in the prompt | The model's intention | Every run, as a preference | Anything the model decides differently today |
| Account permissions | What the tools will return | On every call | Anything inside the granted scope |
| Check during the task | The step the agent takes next | Mid-run | Steps you never thought to name |
| Activity log | Nothing | After the fact | Everything, but you can see it |
The log restricts nothing, and it still belongs in the table, because it is the only row that can answer "what did it do" six months later.
What transfers to a company of twenty?
Three settings, all of them already in the accounts you pay for.
Half of what Nvidia announced is already free. OpenShell is open source and on GitHub, and a brokerage in Dubai has no use for the BlueField watchdog that does the quarantining. What transfers without any of it is the principle, and it lands in three settings.
- Give the agent its own account. Most integrations run under whoever clicked "allow", which means the agent inherits a human's full access to everything that person can reach. A separate account is free in every business suite, and it turns the permissions question into something you can answer.
- Grant read where the job is reading. Drafting replies needs the thread; sending is a separate grant. Sorting deals needs the pipeline, and deleting from it is nobody's job. Write access exists on most connections because it came bundled, and the grant screen rarely makes that obvious.
- Scope the reach as well as the verb. Point it at one mailbox, one folder, one pipeline. The verb says what the agent may do, and the scope says how much of the company it may do it to.
None of this requires a security team or takes a week. It only has to happen at the moment of connection, while the grant screen is still open and somebody is paying attention.
Which agents are already connected is a separate question, and usually a worse one. We went through it in the piece on who in your company has already connected AI to your data.
How do you tell when an agent has too much?
Ask one question per permission, and read the answer honestly.
Open the permission list on a connection you already made. For each line, ask what task needs it this week. Anything justified by what the agent might conceivably want later has no answer yet.
Three answers mean you have granted too much. "It came with the integration" means nobody chose it. "In case we need it" means the need is hypothetical and the access is real. "I do not know what that one does" means the scope was written for a platform, so somebody has to read it against your company.
Look for write access where the work is reading. An agent that summarises a mailbox has no use for send, and one that reports on a pipeline has no use for stage changes. Those grants are usually accidents of setup, which is what makes them easy to take back.
The stronger the model, the more this matters. A weak model with broad access mostly failed to do anything interesting. A capable one takes the path you left open, which is the argument we made when the model got stronger and the limits did not.
Then there is the agent nobody registered: the tool an employee connected to their own mailbox with their own card. You cannot narrow permissions you do not know about, and the list comes from asking people, not from an audit tool. The permission review is the second step. Finding out what is plugged in is the first.
What this means for your operation
- The vendors are moving guardrails into silicon because prompt-level limits did not hold. Read that as a statement about prompt-level limits.
- The checks that matter run before the task and during it. One check at the start only covers the steps you predicted.
- Minimal rights are decided at the moment of connection. After an incident you are reconstructing a decision somebody already made.
- An activity log prevents nothing and remains the only way to answer what happened. Turn it on where it is available.
We connect agents to client mail, CRMs and document stores, and the permission set is a decision we make on every one of them. What that decision looks like is on the AI integration page. Tonight, without us: open the third-party app list in your own work account and read what each line is allowed to do.
Danil Ivanov
Founder, KAIVIX
Builds AI systems for companies in the UAE and beyond.