Agents should never hold your API keys. NVIDIA just open-sourced the runtime that enforces it

NVIDIA open-sourced OpenShell: a runtime where agent fleets get kernel-level sandboxes, never hold your credentials, and every policy change is checked by a Z3 SMT prover before a human approves it. Walkthrough of what it actually does.