Bedrock Data is extending its Agent DLP runtime data-loss prevention technology to NVIDIA OpenShell, adding data-aware policy decisions to the sandbox environment used by autonomous AI agents. The integration is designed to address a gap in conventional agent permissions: an agent can be authorized to perform an operation while still handling data that should not be moved, combined or exposed.
As enterprises deploy increasingly autonomous AI agents, security teams are discovering that controlling what an agent can do is not necessarily the same as controlling what an agent can do with data.
Bedrock Data is targeting that gap with an integration between its Agent DLP runtime data-loss prevention technology and NVIDIA OpenShell, an open-source agent runtime that provides isolated execution environments and policy enforcement for autonomous agents.
The integration adds a data-aware policy evaluation layer to OpenShell. NVIDIA’s runtime determines whether an agent’s requested action is permitted within its sandbox, while Bedrock Data evaluates the data involved in that action against enterprise policies before OpenShell allows it to proceed.
That distinction is becoming increasingly important as AI agents and autonomous systems move beyond simple copilots.
An enterprise might give an agent permission to write to a database because that capability is necessary for its task. Traditional authorization can establish that the agent has permission to perform the write, but it may not understand whether the information being written contains customer data, intellectual property or other restricted material.
The result can be a security gap even when permissions are correctly configured.
Bedrock Data’s example is a sensitive-data write to a shared scratch table. The agent may legitimately need access to that table, but the specific data it is attempting to store may not be approved for that destination.
In the new integration, Bedrock Data evaluates the request’s data context and returns a policy decision to OpenShell. The runtime can then block the operation when the data is not authorized for its destination.
NVIDIA OpenShell is designed to provide the enforcement environment underneath the agent. NVIDIA describes it as an open-source runtime with kernel-level isolation and policy controls over processes, filesystems and outbound connections. Its architecture includes a Supervisor Middleware extension point through which external policy systems can participate in decisions. (docs.nvidia.com)
Bedrock Data is using that extension point to introduce an additional layer of data security posture management and runtime data governance.
The company’s Metadata Lake sits behind those decisions. Bedrock says the system creates an enterprise knowledge graph describing what data is, where it resides, where it originated, who can access it and how it is being used. It discovers and classifies information across cloud, SaaS, AI and on-premises environments.
That means the policy decision is intended to be based on the identity and context of the data rather than simply scanning the contents of a request for keywords or patterns.
This is an important distinction for agentic workflows because data can change context as it moves between tools and agents. An agent may receive sensitive information from one system, combine it with another dataset and then attempt to send the resulting output somewhere with a broader audience.
A conventional permission model may not understand that chain.
The Bedrock Data integration attempts to make the restriction follow the data. According to the company, the same policy can prevent sensitive information from being written to an inappropriate database, transferred through an unauthorized tool or included in a public-facing destination.
It also introduces a design-time component. Security teams can use Bedrock Data to assess an agent’s potential blast radius, including the information available to its permissions and where policy violations could occur.
That matters because runtime enforcement is only one part of agent governance. Organizations increasingly need to understand an agent’s potential access before deployment, particularly when autonomous systems can invoke multiple tools or spawn additional agents.
The market is moving rapidly in this direction. Gartner predicts that 33% of enterprise software applications will include agentic AI capabilities by 2028, compared with less than 1% in 2024. The research firm also expects agentic AI to make at least 15% of day-to-day work decisions autonomously by 2028. (gartner.com)
The growth of autonomous systems is consequently creating demand for security architectures that operate at the agent runtime rather than relying exclusively on application-level controls.
Bedrock Data’s approach also reflects a broader shift from identity-centric authorization toward data-aware security. Identity and permissions remain necessary, but they do not necessarily capture the sensitivity, provenance or permitted destination of the information being processed.
For NVIDIA, the integration strengthens OpenShell’s position as an extensible runtime security layer for agentic AI. NVIDIA is building a broader AI security stack around infrastructure, including BlueField DPUs, DOCA and OpenShell, while third-party security providers can add specialized controls.
That ecosystem approach could become important as enterprises deploy agents across multiple models, tools and infrastructure environments.
The competitive landscape includes cybersecurity vendors such as Palo Alto Networks, CrowdStrike, Microsoft and Trend Micro, alongside specialist AI security companies developing controls for prompt injection, agent identity, runtime behavior and sensitive-data handling.
The harder problem is coordinating those controls without creating a separate approval step for every autonomous action.
Bedrock Data says its integration is intended to let clearly permitted actions proceed automatically while escalating only decisions that policies cannot resolve. That could reduce the tension between security and agent autonomy: organizations can allow agents to perform more work while maintaining policy enforcement at the point where data actually moves.
Ultimately, the development highlights an emerging principle in enterprise AI security: securing an agent is not only about restricting the agent. It is also about understanding the information that agent is carrying, what it is allowed to do with that information and where that information is going.
As autonomous agents begin operating across enterprise systems at greater scale, data-aware runtime controls could become a foundational component of the AI infrastructure stack.
Market Landscape
Enterprise AI security is expanding from model protection and identity management toward runtime agent governance and data-aware authorization. NVIDIA OpenShell provides isolation and enforcement at the agent boundary, while integrations such as Bedrock Data’s add contextual data policy decisions.
The shift is partly driven by the growing number of autonomous systems. Gartner expects agentic AI to become embedded in one-third of enterprise software applications by 2028. (gartner.com)
As agents gain access to databases, MCP tools, APIs, code repositories and enterprise applications, security architectures increasingly need to evaluate not just who is acting and what operation is requested, but also what data is involved and where it is going.
Top Insights
- Bedrock Data adds data-aware policy decisions to NVIDIA OpenShell’s agent sandbox, addressing risks that conventional permissions cannot distinguish.
- The integration can evaluate sensitive data based on its context, provenance and destination before an agent action is allowed.
- NVIDIA OpenShell provides the enforcement boundary, while Bedrock Data supplies the enterprise data context used to make policy decisions.
- Design-time blast-radius analysis gives security teams visibility into what agents could access before autonomous workflows reach production.
- Data-aware runtime controls could allow enterprises to increase agent autonomy without requiring human approval for every routine action.
Power Tomorrow’s Intelligence — Build It with TechEdgeAI
