The problem with agent guardrails that live inside the agent: a compromised agent can override them. Claude Code and Cursor ship with internal safety prompts, but those protections are inside the same process they’re supposed to guard. A prompt injection or a bad third-party skill has access to the same runtime.
NVIDIA OpenShell moves the enforcement point outside. It wraps any agent in an isolated container with YAML-defined policies the agent cannot read or modify. Network access is deny-by-default and hot-reloadable; filesystem and process constraints are locked at creation. The agent can’t escalate privileges because the kernel won’t allow it - not because the agent was told not to.
The setup is one command:
openshell sandbox create -- claude # or opencode, codex, copilot
Policies are enforced at the HTTP method and path level. An agent can GET from GitHub, but POST to create issues is blocked by the proxy - not by a prompt.
The privacy router is also interesting: it keeps sensitive context on local models and only routes to frontier APIs when policy explicitly allows it.