Building Agent Systems for Both Long-Horizon Capability and Enforceable Security

Community Information Announcements
1

A frontier model is only one component of an AI agent. The surrounding system determines how the agent uses tools, maintains state, learns from feedback, recovers from failure and progresses through long-running work.

NVIDIA’s Agentic Variation Operators (AVO) research looks at the capability side of that system. AVO is a general-purpose architecture for long-horizon autonomous work, built around persistent memory, execution tools, external feedback and supervision. It was developed for difficult software-engineering and GPU-kernel optimization tasks, then applied to ARC-AGI-3—an interactive reasoning benchmark where agents must discover goals and rules through interaction.

The broader lesson is that agent performance is a system property. A model may supply the reasoning capability, but memory, tools, feedback, and recovery determine how effectively that capability carries across a long task.

That raises an equally important question: as agents become more capable, where should their security boundaries live?

Our trusted agent stack post argues that prompts, model safeguards and harness logic can guide an agent’s behavior, but they do not create an authoritative boundary around what it can do. The agent and harness should be able to propose actions; identity, policy enforcement, credentials, isolation, and auditability should remain in the runtime environment.

This distinction matters because the harness is intentionally programmable. It can be extended, modified, and composed with new tools. Security controls that depend on the harness behaving exactly as expected can weaken as models, tools, and agent workflows evolve.

A practical design principle is:

  • Above the boundary: models, agents, harnesses and tools can reason, plan and propose.

  • Below the boundary: the runtime binds actions to identity, applies policy and enforces what is allowed.

NVIDIA OpenShell is designed for this runtime-control layer. It helps establish boundaries around what an agent can access and do, rather than relying on the agent to voluntarily follow its own limits.

The two posts are complementary, not interchangeable. AVO explores how to build an agent that can make sustained progress. The trusted agent stack explores how to make sure that progress happens within enforceable limits.

Resources