SAP and Nvidia are expanding their technical collaboration around Nvidia OpenShell, as the companies work to add stronger security, governance and auditability to autonomous AI agents operating inside enterprise systems.
The development follows Nvidia's September 28 launch of its Open Agent Safety Platform and broader availability of OpenShell. SAP is embedding the open-source runtime within the SAP Business AI Platform while its engineers contribute directly to the OpenShell codebase.
OpenShell is designed to place AI agents inside isolated environments and enforce policies governing what files, networks, processes and services they can access. Nvidia says permissions are controlled outside the agent's own process, with allow and deny decisions recorded for auditing.
SAP plans to pair these runtime controls with Joule Studio, its environment for developing and managing enterprise AI agents. The two layers address different parts of agent governance. Joule Studio can determine whether an action should be allowed based on business roles, authorisations and process context, while OpenShell controls how an approved action is executed and what resources the agent can access.
The companies are also working to connect OpenShell's runtime isolation with SAP's enterprise identity and access management frameworks and audit trails. Their roadmap includes work towards FedRAMP, FIPS and requirements relevant to regulated industries.
SAP's engineering contributions span the architecture and operation of OpenShell. These include separating supervisor and agent execution components so they can scale independently, adding Kubernetes-related capabilities, improving private container registry support and extending compute driver compatibility across enterprise infrastructure. SAP is also contributing to health monitoring and structured logging.
The collaboration builds on plans announced at SAP Sapphire earlier this year, when SAP said OpenShell would provide the secure runtime underpinning Joule Studio. At the time, the companies positioned the work around allowing specialised agents to operate across enterprise processes while remaining within defined technical and business boundaries.
OpenShell is also part of Nvidia's broader Open Agent Safety Platform, alongside Nvidia Sentry. Sentry is a reference system design using BlueField-4 DPUs to monitor agent activity independently and can quarantine agents that move outside defined boundaries, according to Nvidia.
For SAP, the latest work focuses on making agent actions traceable and subject to existing enterprise controls as companies move AI agents from experiments into business systems where they can access data, use tools and execute tasks.
Disclaimer: This article may include information derived from interviews, press releases, public statements, research, company communications and other publicly available or third-party sources. Such material may be summarised, paraphrased or contextualised for journalistic and editorial purposes. All rights in third-party content remain with their respective owners.