The Boundary Belongs Outside the Agent. Who Checks the Boundary?

The Boundary Belongs Outside the Agent. Who Checks the Boundary 01

The Announcement

On 28 September NVIDIA announced its Open Agent Safety Platform: open-source runtime software that sandboxes AI agents, and an optional hardware layer that watches them from outside the machine they run on.
The reasoning behind it is the interesting part. In NVIDIA’s words: “enterprises need an enforceable boundary outside of the model and agent harness.”  And, from its engineering team: “an agent in these circumstances cannot be expected to fully govern its own behavior.”
Their comparison is the web browser: “The internet was not made secure by requiring that web developers promise to be good.” It became safe when the browser stopped trusting the page.

We Have Been Here Before

On this blog on 12 September we argued that pacing AI is not enough and that we need runtime control. On 20 September we asked who verifies the guardrails. We have no connection with NVIDIA. Its engineers reached the same place independently, with far more resources than ours, and it is useful to see the argument made at that scale.

A Boundary Is Also an Artefact

NVIDIA’s software checks an agent’s policy before the agent runs: “a prover shows that its policy cannot escape the intent of the operator.”
That is a real step. It is also a claim about the policy. Whether the running system behaves as the policy says is a second claim, and it needs its own evidence. A written limit, a passing test and a clean dashboard are all artefacts. Each one says something happened. None of them proves it on its own.

Five Questions Before You Trust an Agent

Before you let an agent act for you, or ship software that contains one, ask:
1. Which agent acted? Can you name the model, the version and the workload behind each action?
2. What was it allowed to do? Is that written down somewhere other than the prompt?
3. Is the limit enforced, or only described? What happens when the agent tries anyway?
4. Can you reconstruct what it did? From records the agent could not edit?
5. What stops it? Who can stop it, and how fast?
If an answer is “the model was told not to”, you have a description, not a control.

What This Means If You Build With AI

Most apps built with AI tools this year will never run on data-centre hardware with an out-of-band watchdog. The question still applies to them, and to the code itself: the thing that says the software is fine is not evidence that it is.
Trust Before Ship reviews AI-built software and reports what the evidence supports, and nothing more. If you are about to take responsibility for something an AI helped build, contact us before you ship.
Sources: NVIDIA Newsroom, “NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment”; NVIDIA Technical Blog, “NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring”. Both read 29 September 2026.

Recent Posts