SAP and NVIDIA launch OpenShell: A security foundation for enterprise AI agents

SAP and NVIDIA have announced a deepened collaboration to develop OpenShell, an open-source runtime platform specifically designed for the safe and auditable deployment of AI agents in enterprise environments. This partnership marks a significant step in defining what “enterprise-grade” means for autonomous AI systems.

What is OpenShell?

OpenShell is an open-source secure runtime developed by NVIDIA, providing an isolated execution environment for autonomous and self-evolving AI agents. The platform focuses on controlling what agents can see, what they can do, and where inference takes place.

Unlike conventional AI frameworks, OpenShell is built from the ground up with enterprise security in mind: runtime isolation, access control, and full auditability.

SAP’s role in the project

SAP engineers are contributing directly to the OpenShell codebase across four key areas:

Platform architecture: SAP has helped drive the decomposition of the runtime into independently deployable components, separating the supervisor and agent execution layers so they can scale independently.

Kubernetes-native operations: Contributions include operator support, image pull secret management for private container registries, custom volume claim templates, and foreground deletion of sandbox resources.

Gateway optimization: SAP has worked to minimize the gateway image footprint and extend compute driver support for heterogeneous enterprise infrastructure.

Health monitoring: Contributions to supervisor health monitoring and structured log-level configuration bring the runtime to enterprise observability standards.

Joule Studio — Governance above the execution layer

While OpenShell provides a secure runtime boundary, Joule Studio runtime helps determine whether an action should execute at all. It applies business authorization, role-based policy, and process context before a request reaches the runtime.

The combination of these two layers creates a complete integrated stack: OpenShell ensures execution containment, while Joule Studio ensures business accountability.

Collaboration goals

SAP and NVIDIA are working toward:

• Hardening the OpenShell runtime for enterprise-scale deployment, including in regulated industries with strict security and compliance requirements
• Connecting runtime isolation with the business governance layer of Joule Studio, linking technical execution boundaries to enterprise authorization models, IAM frameworks, and audit trails
• Pursuing FedRAMP, FIPS, and regulated-industry enablement on a committed roadmap
• Advancing open research and AI safety through the Open Secure AI Alliance, of which both SAP and NVIDIA are founding members

What this means for enterprises

This collaboration addresses one of the biggest challenges in deploying enterprise AI agents: how to harness the power of autonomous AI while maintaining control, auditability, and regulatory compliance.

For organizations considering AI agent deployment, OpenShell and Joule Studio provide a clear path forward: an open-source secure runtime combined with an enterprise governance layer, all pre-integrated and backed by two technology giants.

Joule Studio runtime is currently available free of charge for SAP customers and partners through October 2026.

---

Source: SAP News Center — September 2026