Anthropic’s September 28 collaboration with NVIDIA puts a useful boundary at the center of agent security: some limits need to be enforced outside the model that chooses actions. The announcement describes how Claude Managed Agents and NVIDIA OpenShell can provide separate controls around credentials, execution and resource access. Anthropic’s account
Managed Agents runs the agent loop separately from its sandbox, where work is executed. Anthropic says credentials are held in another vault so the agent never sees the passwords and keys themselves. It also describes audit trails and integration with an organization’s existing access controls. Separating a credential from model context is a concrete design choice; it does not, by itself, determine which authorized actions the agent should perform.
OpenShell supplies a different layer. According to the source, it blocks actions unless policy permits them and enforces rules for tools, files, network connections and data outside the agent. It records both allowed and blocked decisions. Teams can choose their own sandbox infrastructure, and the source describes OpenShell as open source under Apache 2.0.
The post also describes a policy prover that mathematically checks what the agent can reach under the rules a team wrote. That scope matters. A proof about permitted reachability is not a proof that the entire task is safe, that the rules express the organization’s intent or that every result is correct.
My inference is that these layers address different failure paths and need different evidence. Credential isolation concerns secret exposure. External policies concern execution boundaries. Audit trails concern observability. A convincing adoption decision should establish how those controls behave together for the intended work.
The announcement does not provide an independent assurance result or universal protection guarantee. It also does not require every organization to adopt every layer; the stated design is modular.
For teams considering autonomous agents, the useful question is therefore where each restriction is enforced and how a violation becomes visible. The collaboration gives a concrete architecture to examine, while the policy’s quality and the limits of the permitted task remain organizational decisions.