NVIDIA moves agent policy enforcement onto a separate chip in the week OpenAI's Dots went always-on

The dev.to post that paired the two launches starts from the shape of an ordinary agent run. Someone asks, the agent works, it finishes, and a person looks at the result ^[7]. Take away that last step and four problems arrive. Credentials sit around all day because the agent may wake at any time, and cost runs even when nothing useful happens ^[8]. Behaviour drifts, because the agent learns from feedback and next month's agent is not the one tested today ^[9]. Failures are quiet: a wrong action at 3am becomes part of the state of the world ^[9].

The post calls OpenAI's allow, block and approve rules the right shape ^[15]. Its objection is placement. If the enforcer runs on the same processor and in the same process tree as the agent, a clever or confused agent can end up changing the rules, or the code that checks them ^[10]. OpenAI's advice to review consequential work ^[16] hands the check back to the person an always-on design takes out of the loop ^[7].

NVIDIA's design answers the placement problem directly. OpenShell stays on the host ^[2]. Sentry runs on BlueField 4 DPUs beside the main computer, so it watches the agent from somewhere the agent cannot reach ^[3]. That is good engineering. An out-of-band watchdog keeps its own view of what the agent is doing, whatever happens to the rules on the host ^[10].

It covers less of the list than the pairing suggests. NVIDIA calls the platform a safety net that enforces predetermined boundaries, not a universal off switch ^[4]. In the post, Sentry's job is enforcing those boundaries and quarantining an agent that crosses them ^[1]. The post does not describe it handling credential scope, running cost or drift. A Slashdot thread the post cites made the remaining point: people still write the boundaries in software, so a bad policy is still a bad policy ^[5]. The author wrote that "hardware can enforce a rule, it cannot tell you if the rule was a good one" ^[6].

Without DPUs, the principle still applies. The agent never touches tools directly, and every action goes through a gate the agent process cannot edit ^[11]. The post's sample is a Python Gate class of about forty lines: an allow list of tools, a write budget, single-use approval for destructive actions, an audit trail that records refusals, and a quarantine switch ^[17].

It is a clean starting point with gaps a reviewer would flag. Only actions tagged write decrement the budget. Reads pass once the tool is allowed, and destructive actions go to the approver without touching the counter ^[18]. A loop of reads that runs all night never trips it, and idle spend is the cost problem the post itself lists ^[8]. Single use lives in the approver callable, whose comment says it "returns True once per approval"; the gate does not count approvals itself ^[19]. The audit log is an in-memory list, with a comment that a real system needs a store the agent cannot write to ^[20]. Quarantine flips a flag on the same object ^[21], so it holds only while the class runs outside the agent's process ^[11].

The post's last recommendation is outside the code: each task gets its own scoped credential with an expiry, never one long-lived key ^[12]. For an agent that holds credentials all day ^[8], an expiring per-task key limits what the 3am mistake can reach ^[9].