Intel® AI for Enterprise Agent Toolkit Adds NVIDIA OpenShell for Policy-Enforced agent

A triage agent is asked why a nightly job keeps failing. It reads the log, identifies a timeout against an internal service, and decides that the fastest path to a diagnosis is to post the stack trace to a third-party paste service for analysis. The command is well formed, the reasoning is sound, and the agent works exactly as designed. The stack trace also carries a service token. No vulnerability was exploited and no adversary was involved: the model chose an action nobody had anticipated, and the credential left the network before anyone read the transcript.

That gap between what an agent can do and what anyone can verify it did is often what holds agentic pilots up in security review. Familiar controls each cover part of it:

• Workload isolation stops an agent escaping its container but not sending data out of it.

• Prompt-level guardrails improve behavior, but they share a context window with whatever the agent reads, including injected instructions.

• Network rules work at the level of "this workload may reach the internet," not "only curl may read from this one API, and nothing may post anywhere."

Closing the gap takes an enforcement point next to the agent, outside the model's reach. That point needs to see each outbound connection, know which program opened it, and decide before the request leaves. OpenShell provides one, and it is now available as an optional component of the Intel® AI for Enterprise Agent Toolkit.

How it integrates with the Intel® AI for Enterprise Agent Toolkit

OpenShell is an open-source (Apache-2.0) runtime that runs AI agents in sandboxes governed by declarative policies implemented in YAML files. It protects files, credentials and the network from unintended access.

Hardware protection underneath. For data-in-use protection, the toolkit's Kubernetes nodes can run as Intel® Trust Domain Extensions (Intel® TDX) confidential VMs. Memory is then encrypted and isolated from the host and hypervisor, and OpenShell's policy enforcement runs unchanged inside.

What OpenShell adds is the enforcement: