The key to a good AI agent sandbox is isolation, the ability to implement policy enforcement/governance, and one of the most important pieces to the puzzle - scalability. Without the ability to scale for resource consumption, cost savings, high availability, and disaster recovery, your sandboxed workloads crumble.
In this blog post, I’ll break down the key differentiators between two sandboxes for agentic workloads, kagent v1 + Agent Substrate and NVIDIA OpenShell, to showcase the best solution for scale, high availability, and disaster recovery.
Agent Substrate vs. NVIDIA OpenShell At A Glance
What Are Agent Substrate and NVIDIA OpenShell?
Think of Agent Substrate as the underlying layer that manages, schedules, snapshots Agents, and ensures that agentic workloads not only run efficiently and with performance in mind, but with top-rated security via hardware and software-level isolation out of the box. It’s the lower-level primitive that is handled for you for all things AI Agent isolation. If you want a comparison, think about how Kubernetes works as a whole. You provide YAML or JSON for a configuration that you want running in your k8s environment. Once you apply said configuration, k8s figures out where it needs to be scheduled and what it needs to be connected to (imperative vs declarative - “tell me what to do, not how to do it”). Combining the lower-level power of Substrate with kagent, you get multi-cluster capabilities, session snapshotting/storage, policy enforcement with agentgateway, scalable WorkerPools/Workers (Workers run via Pods and Agents/Actors run in said Workers), and disaster recovery (DR) along with high availability (HA) solutions for how/where memory/context/state/sessions is stored.
With NVIDIA OpenShell, on the other hand, it’s primarily focused on the security aspects (policy enforcement, ensuring AI Models behave safely, and zero access), which is drastically important, but those things (and security as a whole) shouldn’t just be a “feature”, it should be what’s expected out of a robust, production-ready agentic sandbox solution.
OpenShell, although it has some scalability within its implementation, focuses primarily on policy and governance needs. This is, of course, incredibly important, but the key with Agent Substrate and kagent v1 is that policy and governance is table stakes. It comes out-of-the-box with these needs (and gives you the ability to combine agentgateway for observability, policy enforcement, guardrails, and governance for the LLMs, MCP Servers, and other Agents your Agent may be talking to) vs it being another feature. OpenShell is categorized as an “independent security layer”, and Agent Substrate is categorized as the security layer + high-density, scalable, highly available AI + the heavy lifting of scheduling Agents to run efficiently. With OpenShell, efficiency and hardware-resource usage is a major factor as well. OpenShell assigns one Agent per Pod in a Kubernetes environment, a supervisor Pod for each sandbox (an extra Pod per each sandbox), and it’s long-lived, which is a major resource concern when it comes to CPU and memory. Actors via Agent Substrate run in Workers (Pods), and you can have many Actors run on a Worker, along with the fact that Actors aren’t always running (they go into a suspended/warm state which frees up hardware resources).
Architecture: Agent Substrate vs. NVIDIA OpenShell
Substrate is built to keep a large number of Agents idle as snapshots and run only the ones that are awake. They aren’t in a cold state when they aren’t “awake”, they’re in a “warm” state, and with the performance of how the Agent Substrate API “wakes up” the Actors (Agents), the “wake up” isn’t something you’re waiting seconds to complete. This is important for scalability because the Actors can easily “wake up” on a new Worker using the snapshot that was taken and no context/session is lost in the process. This makes moving between Worker Nodes in Kubernetes much easier in an environment that’s multi-node and cross-region. When the Actor comes back up, it has the ability to be restored on any Worker that has room, including a Worker on another Worker Node.
OpenShell is built to keep each sandbox running and reconnect its supervisor if the gateway moves. OpenShell can move the gateway connection, but it can’t move the running sandbox. The workload Pod (where the Agent lives) stays on the same Worker Node, so if the sandbox freezes the Agent, and only the same supervisor Pod process can resume it, that means a new supervisor Pod can’t take over. This breaks a highly available, cross Worker Node architecture.
Durable Context, State, and High Availability for AI Agents
Sessions, along with memory/context need to be stored in a scalable, redundant database which ensures that you can pick up where you left off with your Agent, and this is incredibly important. Imagine a time where you’re done with work for the day and you want to resume work the next day. You want the ability to still be able to hit your session with the same context that you already had instead of starting over. The same scenario goes for if another person on your team or another team is going to pick up where you left off. This is where the importance of snapshots in a durable, highly available location that can fit into your DR strategy comes into play.
The same rules apply for cross-region, cross-k8s-worker-node architectures. If you want the ability for Agents running in a sandbox to not be stuck on a Worker and can freely scale out to other Worker Nodes across your cluster, the ability to move said Agent without it breaking needs to be taken into account.
Wrapping Up: Which Agent Sandbox Should You Choose?
Agent Substrate makes compute disposable, Agents that scale up and down with sub-millisecond response times, and keeps state durable. Combining that with kagent Enterprise gives you out-of-the-box scalable databases for memory/context/sessions, multi-cluster management, and connectivity to Agents running within Actors wherever they may live.
For more on why isolation alone isn’t enough, read Why sandboxing your agent is not enough.
%20(1).png)
%20a%20Bad%20Idea.png)
