Red Hat and NVIDIA put agent boundaries outside the model in a new AI Factory design

Red Hat and NVIDIA are expanding their joint AI Factory design around a simple architectural claim: an autonomous agent should not enforce its own safety boundaries. Those controls should sit in the runtime, inference layer and infrastructure beneath it.

The companies’ October 21 announcement joins three pieces that are often treated separately: sandboxing for agent actions, governed access to shared models, and hardware enablement for the next NVIDIA platform generation.

What changed

At the runtime layer, Red Hat said it is working with NVIDIA on the OpenShell Reference Architecture and supporting that architecture through Red Hat AI Factory with NVIDIA. OpenShell is the open-source sandbox runtime at the center of the design, intended to provide guardrails, operational visibility and runtime isolation outside the agent itself.

The inference layer is a reference design that combines Model-as-a-Service access control and an AI gateway with vLLM, llm-d, NVIDIA Dynamo and NVIDIA NIM. Red Hat says the design provides self-service model discovery, fine-grained access policy, rate limiting, subscription entitlements, quota management and cost attribution while keeping access governance separate from model execution.

The announcement also adds NVIDIA Nemotron 3.5 Super VL support in vLLM and Red Hat AI Factory with NVIDIA. Red Hat points to FP8 and speculative-decoding checkpoints produced with its LLM compressor as examples of how the model can be tuned for lower serving latency while keeping the checkpoint-generation process visible.

At the infrastructure layer, Red Hat committed to Day 0 enablement for NVIDIA Vera Rubin systems across its open hybrid cloud portfolio. Red Hat Enterprise Linux for NVIDIA now supports Vera CPUs, while Rubin platform support is described as enablement for upcoming hardware rather than a currently shipping deployment target.

A separate Red Hat engineering post explains the isolation model in more detail. OpenShift 4.22 supports BlueField-3 DPUs in a dual-cluster topology: tenant workloads run on the host CPUs while networking and security services run on the DPU’s Arm cores in a separate trust domain. NVIDIA Sentry and DOCA Argus can inspect selected host-memory structures from that domain and emit runtime threat alerts without a host-resident monitoring agent. An integrated security system can then isolate a workload’s virtual function through BlueField.

Who should care

The design is most relevant to platform teams building a shared agent service rather than a single application. It treats agent sandboxes, model authorization, quotas and chargeback as platform controls that can be standardized across teams.

It also gives OpenShift AI architects a clearer boundary between governance and execution: the gateway decides who can use a model and under what limits, while vLLM, llm-d and NVIDIA components handle the serving path. The BlueField design adds another boundary by placing monitoring and policy controls outside the host that runs the agent workload.

What to do now

Teams evaluating the architecture should separate what is available from what is planned. Red Hat says the joint use cases and reference designs are available through partners including Cisco, Dell and Lenovo. But it also says native integration of the OpenShell Reference Architecture into Red Hat AI and Red Hat AI Factory with NVIDIA is an active collaboration, not a completed product feature.

The practical next step is to test the reference design against existing identity, quota and observability requirements, then validate that sandbox policy remains enforceable when agents call tools or other services. Teams considering the BlueField path should also verify their threat-response integration: Argus produces monitoring and alerts, while isolation depends on an integrated security system acting on them. Hardware planning for Vera Rubin should remain a roadmap exercise until Red Hat publishes concrete platform compatibility and support details.