# NVIDIA, IBM and SAP moved agent control below the model. Only the identity layer ships today

URL: https://www.thedeepfeed.ai/posts/2026-10-27-agent-controls-move-below-the-model/
Category: Agents
Published: 2026-10-27
Author: the-deep-feed
Tags: agents, security, governance, nvidia, ibm, sap, hashicorp, openshell, identity
Kind: news

> Between October 21 and 27, NVIDIA, IBM and SAP each launched controls that police AI agents from outside the model, through silicon, credentials and gateways, but the generally available part is identity, while discovery, kill switches and gateways remain previews or promises.

## TL;DR

- In **seven days**, NVIDIA (Oct 21), IBM and SAP (both Oct 27) shipped agent controls that sit outside the model: a DPU watchdog, per-agent credentials, and a governed gateway for third-party agents.
- IBM's **Agent Identity** and **Vault 2.2** are generally available. Its agent discovery and **kill switch** are in tech preview, and SAP's **Enterprise AI Gateway** is described in the future tense with no date.
- NVIDIA's reference architecture names **11** security vendors and lets enterprises run agents from **OpenAI** and **Google**, two of the companies Gartner said were missing from its September safety platform.
- IBM cites Gartner: **150,000** agents per Fortune 500 company by 2028, and only **13%** of organizations who think their agent governance is adequate.

Over seven days in October, NVIDIA, IBM and SAP each launched controls that govern AI agents from outside the model, in silicon, in credentials and at the network gateway. The piece an enterprise can deploy today is the identity layer; the discovery, containment and gateway pieces that would stop a misbehaving agent are still previews or promises.

The shared design choice matters more than any single product. None of the three asks the model to police itself. Each assumes an agent will at some point try something it should not, and puts the stopping mechanism somewhere the agent cannot reach.

# NVIDIA puts the watchdog on a separate chip

At GTC Berlin on October 21, NVIDIA [announced](https://nvidianews.nvidia.com/news/openshell-reference-architecture) the OpenShell Reference Architecture, which it says "enables building, containing, observing and enforcing safe agents on enterprise infrastructure and edge systems." The stack assigns each job to different hardware. Models run on Vera Rubin, Vera CPUs run the agent harness inside the open-source OpenShell runtime, and BlueField DPUs run a security framework called Sentry that "provides continuous out-of-band monitoring of agent behavior and in-silicon policy enforcement." The enforcement claim is specific: "if an agent attempts to move outside its software boundary, NVIDIA Sentry quarantines and stops it in milliseconds."

Jensen Huang summed up the division of labor: "agents can think on Rubin, act on Vera and be governed on BlueField." He gave the reason for putting governance on separate silicon in an interview. "Every time an agent is activated, the permissions are different," he told [Globes](https://en.globes.co.il/en/article-nvidia-unveils-israel-developed-ai-agent-protection-architecture-1001560336), whose reporter attended as NVIDIA's guest.

The partner list answers a criticism from September. When NVIDIA launched its [Open Agent Safety Platform](https://nvidianews.nvidia.com/news/open-agent-safety-platform) on September 28 with "over 100 organizations," Gartner's Lauren Kornutick told [CSO Online](https://www.csoonline.com/article/4227843/nvidia-releases-open-agent-safety-platform-to-monitor-and-govern-agentic-ai.html) that some major players were missing from the partner list, naming OpenAI, Amazon and Google. The October page names eight model builders whose agents enterprises can run on OpenShell, including Anthropic, Google and OpenAI. It also lists 11 security vendors, among them CrowdStrike, Okta and Zscaler, that "are integrating support." AWS appears only as one of three cloud operating systems the stack runs on.

The caveat is the one IDC's Brent Ellis raised in September: the platform addresses "probably less than 25%" of enterprise agentic security problems. A DPU watchdog sees what an agent does on the machine. It does not know who the agent works for or what it is entitled to touch, and that is the gap IBM went after.

# IBM gives every agent an account

IBM's [October 27 release](https://newsroom.ibm.com/2026-10-27-ibm-introduces-identity-and-control-for-ai-agents,-securing-frontier-intelligence-for-the-enterprise) treats agents like employees with badges. Agent Identity, used with HashiCorp Vault, "establishes the authoritative record for each agent, such as who owns it, its lifecycle status and the authority it has been granted," and passes that context to Vault's credential controls, "enforcing least-privilege access and enabling real-time revocation when an agent attempts an unauthorized action." Vault 2.2 "gives agents their own secured accounts, automatically renews their credentials and incorporates post-quantum encryption."

The release also announces three watsonx Orchestrate capabilities aimed at agents IBM did not build. Discover "connects to platforms such as Amazon Bedrock, Microsoft Foundry and Google Gemini to find agents built in third-party environments." Contain "runs agents in isolated sandboxes so a rogue agent can't interfere with others," and adds "a kill switch to shut down any agent." Evaluate tests agents, models and MCP servers before deployment and tracks "each agent's model and token use."

IBM ties its identity layer to NVIDIA's runtime directly. Agent Identity and Vault "integrate with NVIDIA OpenShell," which IBM describes as pairing "a protected environment for agents to run in with a verified identity and short-lived credentials for every agent." NVIDIA's John Fanelli supplied the case for the combination: "Businesses need enforceable control over how agents operate and what they can access."

# SAP puts a door on its own agents

SAP's TechEd [announcement](https://news.sap.com/2026/10/sap-teched-ai-developers-build-what-matters-autonomous-execution/), also on October 27, works at the application boundary. Its Joule Work layer will speak the Agent2Agent and Model Context Protocol standards, and SAP says new interoperability features "allow third-party agents to securely invoke Joule Agents through a governed agent gateway." A planned Enterprise AI Gateway "will consolidate authentication, policy enforcement, routing, monitoring, usage tracking and auditing" for AI traffic across the company. SAP's Ted Way put the policy in five words to [SiliconANGLE](https://siliconangle.com/2026/10/27/sap-advances-its-autonomous-enterprise-push-with-smarter-governed-joule-agents/): "Open protocols need governed doors."

SAP is also integrating NVIDIA's reference architecture into the Joule Studio runtime, according to NVIDIA's release, and is offering free deployment of custom agents on that managed runtime to select customers "through December 2026."

# What is generally available, and what is not

Read for release status, the three announcements are uneven. IBM's own availability paragraph is the clearest: "HashiCorp Vault 2.2, Agent Identity, watsonx Orchestrate evaluate capabilities, IBM Concert, and HashiCorp Terraform policy are generally available," while "watsonx Orchestrate discover and contain capabilities are in tech preview." [Techzine](https://www.techzine.eu/news/infrastructure/145292/ibm-deploys-hashicorp-vault-for-ai-agent-identity/) reported the same split. SAP's Enterprise AI Gateway is written in the future tense with no date. NVIDIA calls the reference architecture "now available," but the release gives no ship date for Sentry, the component that does the quarantining.

So an enterprise buying this month can give each agent an owner, a scoped credential and a revocation path. It cannot yet buy, from these vendors at general availability, the tools that find agents it does not know about or stop one mid-action. Those capabilities matter more as agent counts grow. IBM's release cites Gartner's projection that "by 2028 the average Fortune 500 enterprise will use over 150,000 AI agents," and its finding that "only 13% of organizations believe that they have the right AI agent governance in place."

The order in which these pieces ship is not neutral. Identity and credentials let a company say afterwards which agent did what and under whose authority, which is an audit and liability tool. Discovery and kill switches act before the damage is done. This publication [argued on October 13](/posts/2026-10-13-always-on-agents/) that consumer always-on agents leave liability with the user. The enterprise version arriving now does something similar: accountability ships first, and prevention is still in preview.

## Sources

- [NVIDIA Newsroom — NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents (Oct 21, 2026)](https://nvidianews.nvidia.com/news/openshell-reference-architecture)
- [Globes — Nvidia unveils Israel-developed AI agent protection architecture (Oct 21, 2026)](https://en.globes.co.il/en/article-nvidia-unveils-israel-developed-ai-agent-protection-architecture-1001560336)
- [IBM Newsroom — IBM Introduces Identity and Control for AI Agents (Oct 27, 2026)](https://newsroom.ibm.com/2026-10-27-ibm-introduces-identity-and-control-for-ai-agents,-securing-frontier-intelligence-for-the-enterprise)
- [Techzine Global — IBM deploys HashiCorp Vault for AI agent identity (Oct 27, 2026)](https://www.techzine.eu/news/infrastructure/145292/ibm-deploys-hashicorp-vault-for-ai-agent-identity/)
- [SAP News — SAP Empowers AI Developers to Build What Matters and Turn Intent into Autonomous Execution (Oct 27, 2026)](https://news.sap.com/2026/10/sap-teched-ai-developers-build-what-matters-autonomous-execution/)
- [SiliconANGLE — SAP advances its autonomous enterprise push with smarter, governed Joule agents (Oct 27, 2026)](https://siliconangle.com/2026/10/27/sap-advances-its-autonomous-enterprise-push-with-smarter-governed-joule-agents/)
- [NVIDIA Newsroom — NVIDIA Launches Open Agent Safety Platform (Sep 28, 2026)](https://nvidianews.nvidia.com/news/open-agent-safety-platform)
- [CSO Online — Nvidia releases Open Agent Safety Platform to monitor and govern agentic AI (Sep 28, 2026)](https://www.csoonline.com/article/4227843/nvidia-releases-open-agent-safety-platform-to-monitor-and-govern-agentic-ai.html)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-10-27-agent-controls-move-below-the-model/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt