NVIDIA OpenShell tutorial: sandbox your AI agents with live policy updates and audit controls
NVIDIA Developer · youtube · 2026-09-28
NVIDIA Developer published a hands-on tutorial on OpenShell, showing how to place an existing AI agent inside a governed sandbox runtime without rewriting the agent or its harness.
Key points:
- Governed runtime boundary: an orchestrator creates the OpenShell runtime before the harness starts, so the agent, MCP servers, and delegated subagents inherit consistent policy, credential, and audit controls from launch.
- Fine-grained policies: filesystem, network, and process rules configurable at the level of binaries, destinations, methods, and paths; the demo deliberately triggers a blocked action, then shows a scoped policy change being approved and applied live without restarting the sandbox.
- Policy advising with auto-approvals: upper-limit ceilings let routine requests resolve automatically while preventing the agent from granting itself broader authority; short-lived child runtimes inherit controls and cannot exceed parent limits.
- Production features: sandbox grouping for teams, Kubernetes deployment and HA, centralized logs, audit records of what ran/was allowed/denied/changed, plus extensibility APIs for custom policy parsers and credential stores.
The project is open-sourced on GitHub, with a companion tech blog and build.nvidia.com page.
More from coding & agent
- Open-source Three.js game agent skills: 80-run tuning, 5x cheaper QA screenshots — majidmanzarpour · 2026-09-28
- three.js hits 19M weekly npm downloads, and most may be ChatGPT and Claude — cloneofsimo · 2026-09-28
- Former doomer dev: capable models now let him build '10x faster, 10x better' — bennash · 2026-09-28
- Node.js async zstd compression was up to 23x slower — one PR fixes it — DanielLockyer · 2026-09-28
- Right citation, overstated claim: inline source snippets catch AI's missing qualifiers — memokris · 2026-09-28
- Swarms creator Kye Gomez: multi-agent systems are AI's most impactful frontier — KyeGomezB · 2026-09-28