OpenShell 0.1 puts AI agent access control at the OS layer

NVIDIA's OpenShell 0.1 is an open-source runtime for autonomous AI agents, and the mechanism that limits what they can do is the operating system rather than the prompt. File access and system calls are confined by kernel controls, and outbound connections pass a policy check at the sandbox network proxy before they leave (GitHub, architecture, policies). A formal verifier checks that an edited policy would grant no more access than the operator already allows before the change goes live.

Agents never see real credentials. Providers attach keys to requests bound for approved endpoints, so an agent can call a paid model API without holding the key in context (policies). An advisor flags risky new access; a formal verifier then decides whether the policy that would grant it is consistent with what the operator already allows (advisor).

The on-ramp is concrete. OpenShell is at 0.1.x, the default sandbox ships with no agent installed, and the worked example runs OpenCode against a free OpenRouter model (GitHub). Deployment runs on Linux hosts with Docker, Podman, or host virtualization; the support matrix lists WSL 2 as experimental, and Kubernetes deployment requires a NetworkPolicy-enforcing CNI (support matrix).

The falsifier: the verifier checks the policy change, not the outcome. A misconfigured policy still grants too much. There is no third-party security audit, no comparison to gVisor, Firecracker, or E2B, and no disclosed adoption behind the repo, only a Hacker News thread of enterprise-leaning speculation (HN).