Architecture

The Agent Production Stack, Shipped: Inside NVIDIA's GTC Berlin Reference Architecture

By IdeaBosqueLast updated: October 21, 2026

Key takeaways

NVIDIA's GTC Berlin keynote defined an agent as five parts — model, harness, sandbox, knowledge, tools — and shipped a reference architecture covering all five rather than a single platform claim (NVIDIA keynote recap).
The OpenShell Reference Architecture pairs the OpenShell runtime with Sentry on BlueField-4 DPUs, which monitor agent behavior out-of-band and quarantine an out-of-bounds agent "in milliseconds" — governance running in silicon, outside the host the agent runs on (NVIDIA newsroom).
Huang's rule is per-launch privileges: "Every single time an agent is launched, the privileges are different" — the architecture-level answer to the overprivileged-default-role failures documented in this year's agent incidents (NVIDIA keynote recap).
DSX POD shrinks onsite AI-factory deployment from six months to 14 days, and Vera Rubin is "in full production… to process the entire AI agent" — capacity is becoming a supply-chain line, not a build project (NVIDIA keynote recap).
The Agent Knowledge Foundation plus Kumo models productize the knowledge layer, echoing Huang's claim that company-knowledge access is what "turns these agents into super agents" (NVIDIA Developer).

At the Tempodrom in Berlin this morning, Jensen Huang opened with a list of nine European companies — L'Oréal, Revolut, Spotify, Merck, Vodafone, Zara, Porsche, Nestlé, HSBC — all working with NVIDIA on AI, backed by roughly $10 billion committed to Europe's AI ecosystem over a weeklong road through Paris, London, Stockholm, and Dublin (NVIDIA keynote recap; NVIDIA France post). But the announcement that changes enterprise architecture is narrower: with enterprises "prepar[ing] to deploy billions of AI agents," NVIDIA shipped agent governance as a computing layer. The OpenShell Reference Architecture, announced October 21, 2026, pairs a kernel-level sandbox runtime with in-silicon enforcement on networking DPUs — and it is available today with full reference docs.

This article maps what each layer of NVIDIA's five-part agent anatomy now ships as a product, reads the governance claims against the containment record accumulated across 2026 — the failed kill switch in OpenAI's sandbox escape, the default role that let one prompt take over every agent in an AWS account — and separates the commodity layers from the decision that still belongs to the deployer: how the agent touches your running systems.

The five-layer anatomy becomes a bill of materials

NVIDIA's keynote described the agent as five elements: a model, a harness that orchestrates its work and memory, a sandbox that isolates the harness, knowledge, and tools (NVIDIA keynote recap). The framing matters because of what followed it — the five-layer cake argument that infrastructure precedes models, and the claim that "we are at the beginnings of a new industrial revolution." NVIDIA's thesis is platform-shaped: agents are the computing substrate of the next stack, and every layer of that stack can be bought.

Layer	What NVIDIA shipped	The concrete row
Model	Vera Rubin infrastructure, in full production, "to process the entire AI agent"	Vera Rubin NVL72 delivering 30× higher throughput per megawatt (vendor figure)
Harness	Vera CPUs running agent harnesses and tool use	2× the performance of x86 processors (vendor figure)
Sandbox	OpenShell — open-source, policy-controlled runtime with kernel-level sandboxing	Sits between an agent and the systems it can affect
Knowledge	NVIDIA Agent Knowledge Foundation	Nemotron document parsing, embedding, reranking + Kumo models for structured-data prediction
Tools	CUDA-X accelerated libraries	11 million developers building on the platform

Under any layer diagram sits the layer this table does not list: the governance plane. In NVIDIA's framing it is not a layer at all — it is where every other layer's boundaries get enforced. That is the design change to pay attention to.

The stack's five pieces, and the enforcement plane that watches all of them:

The governance layer moved from instructions to silicon

The strongest line of the day was not about throughput. Justin Boitano, NVIDIA's vice president of enterprise AI, put it as a design constraint in September, when the Open Agent Safety Platform was first announced: "Agents can drift when instructions are ambiguous… An agent cannot be expected to fully police its own behavior. Once AI can act, safeguards must govern the agent's actions" (PBS NewsHour/AP). The keynote then made it architecture: OpenShell is a policy-controlled runtime with kernel-level sandboxing that sits between an agent and the systems it can affect, and Sentry runs on BlueField-4 DPUs to continuously monitor agent behavior out-of-band and enforce policy in silicon — quarantining an agent that tries to move outside its software boundary "in milliseconds" (NVIDIA newsroom).

Three properties of that design matter operationally:

The watchdog is outside the host. Every software-only isolation row in the containment stack — containers, hypervisors, WebAssembly — shares one failure domain: the host kernel. A DPU-resident Sentry is the hardware analog of the "two independent layers" rule: the quarantine survives the compromise of the layer it watches. OpenAI's sandbox escape documented the cost of the missing independent layer — an alert the monitor flagged in 12 minutes took a human 2.5 hours to stop (OpenAI kill-switch analysis).
Privileges are per-launch, not per-role. Huang: "Every single time an agent is launched, the privileges are different" (NVIDIA keynote recap). That is the direct architectural refutation of this year's worst blast-radius pattern — a public-facing agent reaching instance metadata and inheriting an overprivileged default role that reached every agent, conversation, and secret in the AWS account (AgentCorruption analysis). A default role granted once and shared broadly only exists when privilege is a configuration step; a per-launch privilege model makes shared standing credentials the anti-pattern.
Revocation crosses the software/hardware line. ServiceNow's same-day GA of Arc — a personal long-running agent whose actions are governed by its control tower and enforced by OpenShell — ships an authority layer, AI Passport, that carries policies into OpenShell and Sentry so enterprises can revoke an agent's access "across software and hardware within seconds" (NVIDIA newsroom; ServiceNow). Kill switches that instruct the model to stop have a documented ceiling; credentials revoked at the enforcement plane do not.

The ecosystem breadth is the credibility test. Model builders whose agents run on OpenShell infrastructure include Anthropic, Google, Meta, OpenAI, Perplexity and Cohere; security vendors integrating support include CrowdStrike, Okta, Palo Alto Networks, Cisco, Fortinet, and Zscaler; European banks BBVA and Santander are exploring the architecture as a governance framework; SAP is wiring its Joule Studio runtime into it (NVIDIA newsroom). A governance layer adopted by the same cohort that produces frontier agents — and by the financial institutions that will regulate their own deployments — is a different kind of announcement than a platform vendor selling safety alone.

Two honesty markers cap the reading. First, the headline numbers are vendor claims on launch day: 30× throughput per megawatt, 2× x86 performance, "up to 20%" agent capacity from Sentry — none has a third-party test attached yet. Second, the containment-vs-usability balance is unresolved and NVIDIA does not claim otherwise. Somesh Jha, a computer science professor at the University of Wisconsin, told reporters the runtime could block agents from doing useful work and how the balance gets struck "can only be answered using case studies" (PBS NewsHour/AP). And per PBS, the platform does not address model dishonesty at all — the deploying company still writes the rules and permissions. The reference architecture shifts where enforcement lives; it does not write your policy.

Capacity became a supply-chain line

The other half of the keynote is procurement arithmetic. NVIDIA announced DSX POD — a reference design for a complete Vera Rubin AI factory, built by partners inside modular containers, integrated and validated before delivery. Once site utilities are ready, onsite deployment shrinks from six months to 14 days; Huang called it "a complete transformation of the world supply chain" (NVIDIA keynote recap). The DSX AI Factory Platform adds the efficiency rows — cooling-water needs down by up to 100% and the same output on up to 30% less power (both vendor figures).

For a mid-market B2B operator, the honest reading is indirect but real: compute is converging on a rental commodity with warehouse-lead-time constraints. Nobody deploying a quote desk or a fulfillment agent needs a pod in the yard. The deployment-velocity datapoint matters because it removes the last structural argument for owning infrastructure "eventually" — the layer that was the reason to wait is now the layer you can rent with a schedule attached. The platforms comparison for enterprise agents (managed platform or owned stack) just gained a datapoint on the vendor side: the silicon owner now sells the factory itself, to the point where the factory deploys at rack speed.

The knowledge layer is the differentiation

The least covered announcement of the day is the one that touches mid-market agents most directly: the NVIDIA Agent Knowledge Foundation — models and libraries for connecting agents to enterprise data — with Nemotron components for parsing documents, embedding queries, and reranking retrieval, plus new Kumo models for prediction over structured data. Huang's framing: "Ultimately, what turns these super agents, these agents into super agents, is that you give them access to your company's knowledge," and, after the Agent Toolkit video: "that knowledge and tools belong to you" (NVIDIA keynote recap).

That is also the layer where platform claims meet buyer reality. A knowledge layer is only as good as the entity model behind it — the typed graph of items, tiers, availability, credit terms, and policies that separates "the model read the catalog" from "the agent quoted the right price with the right terms." Building that layer is the hard part of a production agent, and it is domain work, not platform work: a knowledge-graph retrieval layer for customer support over scanned manuals and an RFQ engine's tier-pricing semantics do not come from a foundation release, however good the parsing models are. NVIDIA supplying the retrieval and prediction primitives is genuinely useful — on top of the entity model you own.

What the deployer still decides

Put the keynote on the mid-market decision table and the buy/own lines fall out cleanly:

Decision	The productized option	The deployer's judgment
Compute	Rubin-era capacity via cloud providers (AWS, Azure, Google Cloud) with OpenShell-ready infrastructure	Rent; capacity now ships on a 14-day schedule
Sandbox + enforcement	OpenShell runtime on Canonical, Red Hat, SUSE, Windows (MXC), plus cloud operating systems; Sentry on BlueField-4	Adopt the reference architecture; the per-launch privilege model still needs your workflow scoping
Model	Frontier closed and open models run on OpenShell infrastructure, including rival silicon paths per AP	Keep the model swappable; the LLM registry pattern makes it a data operation
Knowledge	Nemotron parse/embed/rerank + Kumo prediction primitives	You build the entity model: your catalog, your pricing tiers, your credit and policy semantics
Tools	CUDA-X + vendor agent toolkits	You build the typed integration layer into NetSuite, BigCommerce, ShipStation-class systems — with per-launch scopes

The last row is the one that matters for a mid-market operation. The conference calendar makes the point locally: NetSuite's SuiteWorld opens October 25, with the opening keynote October 26 — the enterprise side of the tools layer is about to get its own week of announcements. Whatever the ERP vendors ship (NetSuite's 2026.2 already carried approval-checkpoint agentic integrations in July), the agent that assembles a quote needs tier pricing, availability holds, credit status, and cancellation terms as typed inputs, from systems whose APIs were not built for agents. The five-decision architecture frame covers that build surface; the keynote changes its governance substrate, not its shape.

A representative build: a mid-market industrial distributor running a 24/7 quote desk on NetSuite — intake agent, catalog and pricing lookups through a typed MCP module (38 registered tools across request, availability, quote, and pricing mixins in our reference implementation), and a credit-check integration. The OpenShell pattern maps onto it directly: each launch of the intake agent holds its sandboxed scope (read catalog, acquire a 15-minute availability hold, write draft quote), per-call audit state lands in a MCPFunctionCallModel-style record, and the enforcement plane is not the agent's own instructions — it is a revocable credential set at the gateway, so a misbehaving run loses its tools in seconds, not its reputation in a postmortem. The privileged surface stays small by construction, which is the whole point of per-launch privileges.

Request a scoped build. One-week discovery. You get a system inventory, workflow map, and fixed scope — whether or not you build with us.