SAP and NVIDIA Integrate OpenShell and Joule Studio to Add Governance and Security to Enterprise AI Agents

# What happened SAP and NVIDIA announced deeper technical collaboration to combine SAP Business AI Platform and Joule Studio runtime with NVIDIA OpenShell, an open-source secure runtime for autonomous AI agents. The objective is to provide an integrated execution and governance stack that places enterprise authorization, policy, and auditability above the runtime that executes agent actions.

# Why it matters for enterprises

SAP engineers have contributed to four main areas of the OpenShell project:

• Platform architecture: decomposition of the runtime into independently deployable components, separating supervisor and agent execution layers for independent scaling.
• Kubernetes-native operations: operator support, image pull secret handling for private registries, custom volume claim templates, and foreground deletion of sandbox resources.
• Runtime footprint and infrastructure support: reduced gateway image footprint and extended compute driver support for heterogeneous enterprise infrastructure.
• Observability and health: supervisor health monitoring and structured log-level configuration to meet enterprise observability standards.

Joule Studio runtime will be embedded with OpenShell within SAP Business AI Platform, and SAP has made Joule Studio runtime available free to SAP customers and partners through October 2026.

# Governance and compliance focus The collaboration emphasizes mapping technical execution boundaries to enterprise governance constructs:

• Linking runtime isolation to enterprise authorization models and IAM frameworks.
• Capturing audit trails that connect agent actions to business roles, policies, and process context before runtime execution.
• Working toward regulated-industry enablement on a committed roadmap, including FedRAMP and FIPS.

These steps target deployment in environments with strict security and compliance needs.

# Broader safety and research activity SAP and NVIDIA are founding members of the Open Secure AI Alliance, a group intended to advance open research and AI safety. The alliance provides a forum for joint research and standards work around secure agent execution and safety controls.

# How this stack is intended to operate Joule Studio runtime acts as the pre-execution gate: it evaluates business authorization, role-based policy, and contextual process rules. If Joule Studio permits the action, OpenShell enforces runtime constraints that limit agent capabilities, data access, and inference destinations. The combined approach is meant to provide enterprises both the business decision point and the technical containment layer.

# Practical implications for IT leaders IT and security teams considering agentic AI should evaluate both governance controls and execution boundaries. This collaboration shows an approach where governance decisions are applied before runtime, and the runtime provides hardened isolation and observability. For regulated workloads, investigate planned compliance certifications and whether the combined stack integrates with your IAM, logging, and audit systems.

# Next steps announced SAP engineers will continue contributing to OpenShell, and SAP and NVIDIA will pursue compliance enablement and joint hardening for enterprise-scale deployment. Joule Studio runtime availability is free for SAP customers and partners through October 2026.