A few weeks ago, I met with a company that was preparing to roll out agents for a few specific use cases. I asked the enterprise AI team a question their governance program couldn't answer: what stops an agent from taking an action your policy prohibits?
On paper, their governance program was strong. Use cases were inventoried, risk-tiered and approved, with a full audit trail. Their program enforced the lifecycle process, but it had no enforcement at runtime. So a running agent could operate outside policy before anyone noticed. They're now reassessing their agent rollout.
I've had a version of that conversation with AI leaders at banks, insurers, healthcare organizations and manufacturers all year. They're under pressure to move agents into production, and their boards and regulators expect proof that policy holds once they do.
Today we announced ModelOp’s Full-Stack AI Policy Enforcement with NVIDIA OpenShell. It centralizes and continuously manages AI policy in ModelOp's system of record and consistently enforces it at four levels of the enterprise AI ecosystem: process, execution, operating system (OS) and network. With our new NVIDIA OpenShell integration, ModelOp is the first AI governance platform to centrally manage and enforce policy at all four.
Why lifecycle governance alone isn't enough for agents
Enterprises have spent years building AI lifecycle management, from intake and risk tiering through validation, release gating and change management, across every team that builds or buys AI. That discipline is what makes AI safe to deliver at scale, and it’s what ModelOp has purpose-built for more than eight years.
Agents raise the bar. A traditional model produced a score and left the action to a person. An agent takes the action itself: it runs code, calls tools, writes files, moves data and connects to outside systems, sometimes without a person’s direct approval. An agent can complete every step of a rigorous lifecycle on its way to production and still violate policy the moment it starts operating.
If governance ends at deployment, you're not enforcing your policy. You're documenting what you hoped the agent would do.
What is Full-Stack AI Policy Enforcement?
Full-stack AI policy enforcement means centrally and continuously managing AI policy and enforcing it consistently at every level where an agent operates: the process that governs its lifecycle, the platform that executes it, the operating system it runs on and the network (i.e. AI and API gateways) it connects to.
Policy lives in one system of record for every single agent, regardless of technology. Enforcement happens at each level, through the system built for it, and results flow back to the centralized system of record.
What's new: OS-level enforcement with NVIDIA OpenShell
ModelOp already enforces policy at the process, execution and network levels. The operating system level presents a unique challenge since it determines what an agent can do on the machine it runs, including which files it can write or move, which processes it can run and which network connections it can open. This is how agents have been able to circumnavigate guardrails set at the other levels. Enter NVIDIA OpenShell.
NVIDIA OpenShell, NVIDIA's open-source secure runtime for AI agents, runs each agent in a sandbox that denies access by default, with kernel-level controls over files, processes and network connections. Those rules are enforced outside the agent's own process, where, in NVIDIA's words, "enforcement cannot be influenced by model output." This is what NVIDIA defines as “deterministic governance.”
ModelOp’s integration turns OpenShell sandbox permissions from isolated technical settings into governed enterprise policy.
What has to be enforced at each level
Process: has every AI solution completed every step its policy requires? The goal is a lifecycle that's consistent, automated, auditable and proportionate to risk. ModelOp runs each AI solution through workflows powered by MADE™, the ModelOp AI Delivery Engine, covering intake, risk tiering, risk-proportional controls, approvals, evidence and release gating, along with asset, data and model management, full versioning, change management and deployment traceability. A use case that hasn't completed its required steps doesn't reach production.
Execution: is the execution platform running the approved version of the agent, under its assigned identity, with required guardrails and telemetry enabled? The goal is to ensure that what runs in production is exactly what was reviewed. ModelOp manages the approved version, identity binding, and execution policy requirements for each agent version, integrating with execution platforms and identity providers such as Microsoft Agent 365, Microsoft Entra and Amazon Bedrock AgentCore.
OS: is each agent confined to a sandbox, with access limited to authorized files, write permissions, network resources and system capabilities? The goal is to ensure that an agent is restricted to only the OS-level resources that its policy allows. ModelOp manages the OpenShell policy for each agent version, keeps every sandbox in sync with it and tracks policy change approvals, exceptions and change history.
Network: is the gateway allowing only approved routes to models, MCP tools and internal and external systems? The goal is to ensure the agent has access to only specific, approved network resources for a given AI use case. ModelOp manages approved routes by use case through AI and API gateways such as Kong, Zscaler and Palo Alto Networks, ensuring that unapproved routes are blocked at the network level, as opposed to allowing the agent to make its own decision on the network resources it can connect to.
Why fragmented enforcement fails
In my conversations, the problem is rarely a missing tool. What we’ve seen is that each level is managed by a different team in a different tool (or, worst case, not managed at all), with no shared record of which policy applies to which agent version. That means that an enterprise can fall into at least three governance traps:
The bypass trap. Blocked on one path, a capable agent looks for another. An AI gateway can block an unapproved API call, but an agent that can write and run code can open a connection the gateway never sees.
The drift trap. When security, platform and governance teams each keep their own copy of policy, the copies drift. A new agent version ships while some enforcement points still apply the old rules.
The evidence trap. Exceptions and decisions scatter across sandbox logs, gateway logs and tickets. When a board, examiner or auditor asks if a policy was followed, no one can show it in one place.
How ModelOp is different
Legacy and point solutions each cover part of the stack. GRC-for-AI platforms document policy and run intake, but enforcement stops at the process. ITSM-based AI control towers route tickets and, in some cases, issue agent identity credentials, which confirm which agent is acting but can’t block OS-level actions such as accessing data locations, writing code to circumvent network policies, etc. Gateways and sandboxes enforce well at their own level, yet each sees one slice of what an agent does and none of the enterprise context behind it.
ModelOp is the Enterprise AI Command Center and system of record for ML, GenAI, Agentic AI and vendor AI, integrating with AI development and execution, security, GRC, ITSM and data management platforms without replacing them. Powered by MADE™, Full-Stack AI Policy Enforcement runs a closed loop across all four levels by managing, enforcing, and observing policy:
Manage. Security, IT and AI governance teams set global policies, solution owners augment with their use case requirements, approvers review policy change requests, and ModelOp records the exact policy each agent version runs under.
Enforce. ModelOp pushes that policy to the enforcement point at every level and keeps it in sync. For OpenShell, it registers gateways, tracks which agents run in which sandboxes and shows each agent version's compliance status.
Observe. When OpenShell blocks an action, ModelOp routes the exception and suggested policy change through configurable review workflows, applies approved changes to the running sandbox and records every decision for audit.
Exceptions, evidence, actions and metrics from every level return to ModelOp's system of record, so workflows and operational intelligence show in one place whether each agent version adheres to policy.
What ModelOp adds to NVIDIA OpenShell
OpenShell is a strong enforcement point on the machine. On its own, though, an operator approves blocked endpoints, file access and write permissions one sandbox at a time, and those approvals reset when the sandbox is recreated. ModelOp carries policy across agent versions, ties every rule to the agent's owner, use case and risk tier, routes exceptions through enterprise review workflows and keeps one audit trail across all four levels.
What it means for your teams
CIOs, CTOs and CAIOs. Scaling agents requires assurance that policy will be enforced in production. With enforcement at every level and one system of record showing which agent versions adhere to policy, you can confidently approve more agents for production.
CISOs and security leaders. Your security stack has tools to enforce guardrails and rules at runtime. What's been missing is one place to define what each sandbox, gateway and identity provider enforces for each agent version. ModelOp provides it and routes every exception to the right reviewers, with the decision on record.
IT architects and platform engineers. Enforcement only scales if it fits the stack you run. ModelOp registers your NVIDIA OpenShell gateways, syncs sandbox policy and applies approved changes automatically, alongside the gateways and execution platforms you already use.
AI governance leaders. You need to show that applicable policies are enforced in production. With ModelOp, a decision made in review becomes an enforced rule on the specific agent version, and exceptions return through your workflow with a full audit trail.
Get a preview
Request a demo to see ModelOp’s Full-Stack AI Policy Enforcement with NVIDIA OpenShell here.
Frequently asked questions
What is OS-level policy enforcement for AI agents?
It's enforcement of what an agent can do on the machine it runs on: which files it can read or write, which processes it can run and which network connections it can open. With NVIDIA OpenShell, those rules are enforced outside the agent's process, with kernel-level controls on files and processes and a policy proxy on network connections.
Does ModelOp replace NVIDIA OpenShell or my AI gateway?
No. OpenShell enforces policy at the OS level, and gateways such as Kong enforce it at the network level. ModelOp is the system of record that manages the policy each one enforces, routes exceptions for review and keeps the audit trail.
Which levels does Full-Stack AI Policy Enforcement cover?
Four: process (lifecycle management, including risk assessment, controls, approvals, change management), execution (approved agent version, identity, guardrails and telemetry references), OS (file, process and network access inside an OpenShell sandbox), and network (approved routes to models, MCP tools and systems).
How is policy enforcement different from agent identity?
Identity establishes which agent is acting and what it's authorized to do. Enforcement stops an action the policy prohibits at the level where the agent attempts it.
