Before you widen your AI agent's sandbox, prove the new policy stays inside your boundary

Coding agents increasingly spin up other agents, and someone has to decide what each one may touch. NVIDIA's OpenShell (opens in a new tab) (Apache-2.0, about 17,800 GitHub stars) runs agents in sandboxes governed by a YAML policy: which files, which user, which hosts, which HTTP methods. NVIDIA pushed it at GTC Berlin on October 21, and it hit Hacker News' front page today. The part worth stealing for your own setup, even before you adopt the whole runtime, is its policy prover.

What it does. openshell-prover check candidate.yaml --boundary boundary.yaml asks one question: does the candidate policy allow anything the boundary doesn't? NVIDIA's docs describe the use case directly: a parent agent checking that a policy it writes for a subagent stays within its own maximum. It uses an SMT solver, reads local files, and needs no gateway, Docker or account. The docs say it covers filesystem access, process identity, Landlock settings, network connections and REST requests.

We ran it. We downloaded the standalone openshell-prover 0.1.5 binary for Linux from the v0.1.5 release (its SHA-256 matched the published checksum file) and first ran the docs' own example. It matched exactly: adding write access to /tmp returned exceeds_boundary with the counterexample filesystem write /tmp.

Then we wrote a realistic boundary: read /usr and /etc, write only /sandbox, Landlock as a hard requirement, a fixed non-root user, gh allowed read-only on api.github.com and node read-only on the npm registry. We tested 14 candidate policies against it:

• Caught (exit 1, with an example): switching GitHub from read-only to read-write (counterexample: POST /), adding /usr/bin/curl next to gh, a new rule letting curl reach pastebin.com, downgrading Landlock to best_effort, and a rule adding DELETE /repos/**.
• Passed (exit 0): dropping the npm rule, an identical copy, and narrowing GitHub to GET /repos/** only.
• Unsupported (exit 3): writing to /tmp or /sandbox/out when the boundary allows /sandbox (the prover won't assume a subfolder is safe, because symlinks in the image could point elsewhere), putting the endpoint in audit mode, adding an MCP endpoint, and changing the user ID from 1500 to 1600.
• Inconclusive (exit 3): adding DELETE /repos/*/*/git/refs/**. It hit the default 10-second limit, and still timed out with --timeout 90s. The broader DELETE /repos/** was caught in 0.44 seconds.

Most checks finished in 2 to 32 milliseconds (median of five runs each).

The trap we hit first. Our first boundary copied the npm example from OpenShell's schema docs, which sets allow_encoded_slash: true. With it, all 13 candidates we had then came back unsupported: "boundary policy rule 'npm' uses authority outside the initial model." One field the prover doesn't model blocked every check, including candidates that only narrowed access. Removing that one line fixed it. If you rely on the prover, keep your boundary to features it models.

The rule. The docs say it plainly: "Only within_boundary means that the check passed. Treat every other result as a failure." In a script, use --output json and read result and reason_code, and check that coverage.domains lists every part of the policy you rely on. Exit codes: 0 within, 1 exceeds, 2 error, 3 unsupported or inconclusive. In our run, nothing we widened ever got a 0.

Our take

If you hand policies to agents, or let agents write them for each other, put this check in front of every change: it's a 33 MB binary and a one-line command. Write the boundary first, keep candidate paths and binaries identical to the boundary's, and fail anything that isn't exit 0. Know its limits too. It reads policy files, not what a running sandbox actually enforces, and NVIDIA's docs say a pass does not mean the policy is "as narrow as it could be" or "safe for a particular task." It means no wider than your boundary.

What we did and didn't do: we ran the standalone prover only, on a Linux box on October 22, 2026; scripts and outputs are in our test notes. We didn't run the OpenShell gateway, a sandbox, its kernel enforcement, or the policy advisor's separate risk check, and didn't test macOS or Windows. Facts come from NVIDIA's OpenShell docs, GitHub repo and v0.1.5 release, read today. Not sponsored; no affiliate links.

MODEL Editors