Field note · 28 September 2026 · 2 min read

OpenShell is the boundary. Polyaxion is the state.

NVIDIA OpenShell decides what a sandboxed agent may reach:

files
hosts
methods
paths

Each decision looks at one request. I don't know what it is with the AI industry, but no one is even trying to address the kind of issues we see in the press pretty much every day now (see my METR post yesterday).

Some rules need memory

You'd think they would have asked Claude by now: do some rules need memory?

Publish after the tests pass
Never send data out after reading a secret and untrusted input in the same session
Stop after a budget of calls

A check that sees one request at a time cannot express these.

Where polyaxion goes

OpenShell's supervisor middleware (RFC 0009, research preview) runs an operator's gRPC service on every admitted egress request, before credentials are injected.

That is where polyaxion goes.

The wiring: polyaxion-openshell in OpenShell's supervisor middleware.

polyaxion-openshell

We have created the polyaxion-openshell:

It speaks the middleware contract (Describe, ValidateConfig, request and response hooks), pinned to the upstream proto.
A real OpenShell gateway negotiates with it and accepts the registration.
A sandbox with the policy relays traffic through it. Each request and its response are logged under one request_id. Query strings never reach the log.
An invalid polyaxion config stops sandbox creation.

OpenShell calls polyaxion on every request, and polyaxion gets what it needs to decide.

What polyaxion remembers

Polyaxion remembers what the agent did earlier in the session. Say the agent reads an untrusted web page, then reads from an internal API, then tries to send data to an outside host. Polyaxion blocks that last request. The agent gets a 403 with the reason code polyaxion_trifecta, and the request is stopped before OpenShell attaches any credentials.

The egress gate: in one session the agent reads an untrusted page, then an internal token, then tries to POST to an outside host. OpenShell allows each request on its own; polyaxion denies the third with reason code polyaxion_trifecta, the agent gets a 403, and no credentials are attached

One session, three requests. OpenShell policy allows each request on its own. Polyaxion blocks the sequence.

Jean-Jacques Dubray · Provable Trust · polyaxion · Zero trust needs the sequence · Governance