OpenShell safe runtime for autonomous AI agent fleets

I came across OpenShell from NVIDIA, described as a “safe, private runtime for fleets of autonomous AI agents.” The core idea (as I understand it) is to move beyond “agents are just prompts + tools” and instead give an agent fleet an execution environment with stronger isolation and control over what runs, what can access, and how state is handled.

This is the kind of infrastructure I care about when an agent system goes from demos to production: once you run multiple agents (or long-lived loops) you need predictable boundaries—network, filesystem, credentials, and resource limits—plus an auditable control plane for runtime behavior.

One concrete situation I’d hit: you want to let an agent do multi-step tasks (RAG retrieval, code/tool execution, ticket updates) across several services, but you don’t want the agent process holding broad secrets or writing to arbitrary storage paths. In that setup, a runtime like OpenShell is relevant because it can enforce policy at execution time rather than hoping every prompt/tool call is perfectly constrained.

What I’d look at first in the repo: - the main runtime entry point and how the “fleet” is started - any configuration/flags that define sandboxing and allowed capabilities - how secrets are provided (and whether it relies on explicit, scoped credentials) - example workflows that demonstrate the safety/privacy guarantees in practice

If you’re building with FastAPI/LangGraph-style agent graphs or Claude Code workflows, this is worth scanning for patterns you can reuse: runtime policy, isolation boundaries, and operational guardrails for autonomous tool use.