SAP and NVIDIA OpenShell: Working Toward Governance and Security for Auditable AI Agents in Enterprise Systems

Feature

Together with NVIDIA, SAP is helping shape and strengthen the execution layer for enterprise agentic AI.

The new AI-first experience for building agents, apps, and workflows

Today, alongside the announcement of NVIDIA Open Agent Safety Platform and the broad availability of NVIDIA OpenShell, we’re deepening our collaboration with NVIDIA to help make enterprise AI agents safer, more governable, and easier to audit by design.

As announced this year at SAP Sapphire, SAP and NVIDIA have a deep technical collaboration, with plans to bring SAP Business AI Platform together with OpenShell, an open-source secure runtime for autonomous AI agents. This is more than a planned integration, it reflects a shared effort to help define what “enterprise-grade” means for autonomous AI systems.

As part of our ongoing co-development activities, SAP engineers are contributing directly to the OpenShell codebase and embedding OpenShell within SAP Business AI Platform. Joule Studio, an AI-first development environment, provides a complete execution and governance stack for enterprise AI agents, while OpenShell supports deploying agents with a focus on safety and security.

SAP and NVIDIA are also working to:

  • Help harden the OpenShell runtime for enterprise-scale deployment, including in regulated industries with strict security and compliance requirements
  • Connect OpenShell’s runtime isolation with the business governance layer of Joule Studio runtime, linking technical execution boundaries to enterprise authorization models, IAM frameworks, and audit trails
  • Work toward FedRAMP, FIPS, and regulated-industry enablement on a committed road map
  • Advance open research and AI safety through the Open Secure AI Alliance, of which SAP and NVIDIA are both founding members alongside other industry leaders

Joule Studio runtime: Governance above the execution layer

Joule Studio runtime helps determine whether an action should execute at all—applying business authorization, role-based policy, and process context before a request in action reaches the runtime. OpenShell provides an open-source runtime boundary designed to help build and deploy autonomous, self-evolving agents more safely. It governs how the agent executes, what it can see and do, and where inference goes. Together, the two aim to give enterprise customers execution containment and business accountability in a single integrated stack.

SAP engineering contributions to NVIDIA OpenShell

SAP engineers are contributing to four areas of the OpenShell project. On platform architecture, SAP has helped drive decomposition of the runtime into independently deployable components, separating the supervisor and agent execution layers so they can scale independently. For Kubernetes-native operations, contributions include operator support, image pull secret management for private container registries, custom volume claim templates, and foreground deletion of sandbox resources. SAP has also worked to minimize the gateway image footprint and extend compute driver support for heterogeneous enterprise infrastructure. Contributions to supervisor health monitoring and structured log-level configuration bring the runtime to enterprise observability standards.

Joule Studio runtime is available free for SAP customers and partners through October 2026—start building today


Andre Lamego is senior vice president and chief product officer for SAP Business AI Platform Fabric at SAP.

SAP Connect: Discover how to maximize SAP solutions across every line of business