Assertion Supported AI assessment confidence: 95% certainty 4/5 debate potential 1/5

NVIDIA OpenShell AI sandboxes strictly enforce deny-by-default access permissions

Adel El Hallak · The Right Way To Build AI Agents — With NVIDIA's Adel El Hallak and ServiceNow's Joe Davis · May 26, 2026 · at 18:22

NVIDIA VP Adel El Hallak describes the security architecture of OpenShell runtime sandboxing for enterprise AI agents.

0:00 / 0:13exact quote · 13.4s

▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark

“The default is no. When you spin up OpenShell, the default at runtime for an agent running in a sandbox is an, you are explicitly giving it access to very specific, you know, processes or actions that it wants to take.”

quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →

The claim, plainly

When running an AI agent in OpenShell's sandbox runtime, the default permission setting is deny-by-default, requiring explicit access grants for specific actions.

a quote alone can be ambiguous, so this restates it with the references and context of the conversation around it resolved. AI-written; the tape below the player is the source.

Assessment

Official technical documentation, public codebase records on GitHub (NVIDIA/OpenShell), and independent technical reviews (such as Red Hat Developer and Dnotitia architecture teardowns) confirm that NVIDIA OpenShell's sandbox runtime operates under an explicit deny-by-default permissions model. Outbound network traffic is routed through a proxy and denied unless explicitly declared in active YAML policies, filesystem access and process execution are restricted via Linux Landlock LSM and seccomp filters to declared paths and binaries, and undeclared actions require explicit policy grants.

OpenShell official documentation confirms outbound TCP connections operate under a default-deny model and are blocked unless explicitly declared in active YAML policies evaluated via OPA.
The GitHub codebase (NVIDIA/OpenShell) and documentation confirm filesystem and process execution permissions require explicit declaration enforced by Landlock LSM and seccomp system call filters.
Independent technical reviews from Red Hat Developer (July 2026) and Dnotitia (April 2026) corroborate that OpenShell enforces a default-deny architecture across network, filesystem, and process domains.

Checked against

[1] nvidia.com [2] htek.dev [3] github.com [4] nvidia.com [5] nvidia.com [6] nvidia.com [7] redhat.com [8] medium.com

Adel El Hallak OpenShell OpenShell sandbox runtime AI agent deny by default permission OpenShell agent sandbox github docs permission

assessed as of 2026-09-02

This assessment is an AI reading of a public statement, made against the cited references with the confidence shown. It can be wrong. The quote, the tape and the references are all on this page; if something is off, use report an error below. full disclaimer →

Mentioned

Adel El Hallak Nvidia OpenShell

⚑ Spot an error? Report it

More from Adel El Hallak

Insight

NVIDIA sees the best agent orchestration results using Claude Opus and GPT

“We've seen some of the best results with using either Opus from Anthropic or GPT for OpenAI for the orchestrator.”

Adel El Hallak May 26, 2026 ▶ 3:29 The Right Way To Build AI Agents — With NVIDIA's Adel El Hallak and ServiceNow's Joe Davis

Assertion Supported

NVIDIA's El Hallak: OpenClaw is the fastest-growing GitHub project in history

“And OpenClaw became the fastest growing GitHub project on GitHub. Like, you look at Linux, it surpassed Linux, it surpassed React in a few weeks, right?”

Adel El Hallak May 26, 2026 ▶ 8:50 The Right Way To Build AI Agents — With NVIDIA's Adel El Hallak and ServiceNow's Joe Davis

Insight

Internet, knowledge base, and terminal access create a 'lethal trifecta' for agents

“Our CISOs, our compliance officers talk about a lethal trifecta in the enterprise context. And that lethal trifecta is when you are intermixing access to the unfettered internet, access to your knowledge base, and a coding terminal. Two of those three, no prob…”

Adel El Hallak May 26, 2026 ▶ 9:03 The Right Way To Build AI Agents — With NVIDIA's Adel El Hallak and ServiceNow's Joe Davis

Insight

NVIDIA's El Hallak: AI agents require multi-model architectures, not single models

“Agents are not a single model, right? We fundamentally believe that agents are made up of a, of an array of different models. Some proprietary models, some open source models that have been customized or post-trained, as they say, right? And so that's ultimate…”

Adel El Hallak May 26, 2026 ▶ 1:55 The Right Way To Build AI Agents — With NVIDIA's Adel El Hallak and ServiceNow's Joe Davis

Assertion Supported

NVIDIA's deep research agent blueprint uses at least seven specialized agents

“That deep research blueprint or agent is actually made up of no less than seven agents”

Adel El Hallak May 26, 2026 ▶ 3:16 The Right Way To Build AI Agents — With NVIDIA's Adel El Hallak and ServiceNow's Joe Davis

Prediction Not checkable as stated

NVIDIA's El Hallak: Future enterprise systems will govern humans, agents, and robots

“I think in a couple years time, we'll be sitting here talking about how AICT governs, helps govern humans, agents, and robots.”

Adel El Hallak May 26, 2026 ▶ 31:31 The Right Way To Build AI Agents — With NVIDIA's Adel El Hallak and ServiceNow's Joe Davis

NVIDIA OpenShell AI sandboxes strictly enforce deny-by-default access permissions

More from Adel El Hallak

Turn any episode into a week of clips.