Bedrock Data, the platform provider for data security and AI governance, today announced it is expanding its role in the OpenShell ecosystem as the open source agent runtime moves to the Cloud Native Computing Foundation (CNCF) as a Sandbox project. OpenShell is the secure runtime that governs how agents execute, which resources and data they can reach, and where inference is routed. With NVIDIA’s contribution of OpenShell to the CNCF, the project shifts from NVIDIA’s GitHub repository to ai-openshell, a neutral organization where it can be shaped by everyone who depends on it. Bedrock Data’s Agent DLP for OpenShell, first released in September, adds data control to the runtime.

OpenShell’s supervisor feature checks every action an agent takes before it executes. Bedrock Data evaluates that same action against the company’s data policies, and those policies can use business context that cannot be seen by looking at the data alone, such as where the data came from and who is allowed to use it. For example, an agent’s summary of a slide from a restricted deal folder contains no pattern a content scanner would catch, but should be considered material nonpublic information because of where it came from.

“With OpenShell governed by the CNCF, teams have a shared runtime to secure agents, which makes it the right place to solve data safety for agents once instead of tool by tool,” said Pranava Adduri, CTO and co-founder of Bedrock Data. “OpenShell provides unified runtime governance for every agent, and Bedrock Data brings the company’s data policies to the runtime, so an action that would violate one is stopped before the data moves, and agent behavior stays aligned with company policy.”

Agent DLP for OpenShell attaches through OpenShell’s Supervisor Middleware, outside the agent sandbox, so agents and their tools do not change. The supervisor hands each permitted request and response to Bedrock Data, which evaluates it against the company’s policies and returns a verdict of allow, redact or deny, with a reason, before data enters the agent’s context or leaves the sandbox. Policies can take into account what the data is, where it came from and which identity or agent is acting, and they draw on the Bedrock Data Metadata Lake, a graph of what the company’s data is, where it lives, where it came from and who and which agents can reach it.

That context resolves cases content inspection cannot. It traces a fragment back to its restricted source, and it recognizes when a customer record is headed to a third-party destination with a wider audience, so policy can redact personal data before it leaves.

Availability

Agent DLP for OpenShell is available today to Bedrock Data customers as an OpenShell supervisor middleware service. Teams can start in observe-only mode, review the verdicts Bedrock Data would have returned and turn on enforcement when ready.

Additional Resources

About Bedrock Data

Bedrock Data is a data security and AI governance platform built on an enterprise knowledge graph of the company’s data: what it is, where it lives, where it came from, who can access it and how it is used. Bedrock Data builds and maintains that graph, its patented Metadata Lake, by discovering and classifying data in place across cloud, SaaS, AI and on-premises environments at petabyte scale, without moving data outside customer boundaries. Its open, API-first design delivers those facts to the tools already in the enterprise stack and makes them the basis for policy enforcement, AI governance and automated remediation. Security, data, infrastructure and AI leaders in technology, finance, healthcare and biotech rely on Bedrock Data to secure their data and accelerate AI without increasing risk. Learn more at bedrockdata.ai.

Media gallery

About The Author
Business Wire