Claude Blog 4 min

Giving companies more control over their AI agents, with NVIDIA

🔗 https://claude.com/blog/giving-companies-more-control-over-their-ai-agents-with-nvidia

📌 【Anthropic × NVIDIA】給企業 AI Agent 上鎖:憑證進金庫,行為進沙盒

TL;DR:Anthropic 與 NVIDIA 聯手推出分層防護架構,讓企業能實際掌控、稽核並限制 AI agent 的行動範圍。

當你的 AI agent 不只是回答問題,而是能讀寫資料庫、呼叫內部 API、代表使用者採取行動時,一個問題會立刻浮現:誰在檢查它做了什麼,又是誰擋住它不該做的事?Anthropic 這次的答案是「把防護拆成好幾層,每一層都能獨立擋下問題」。

🤔 Agent 權限越大,公司越需要能查、能擋的機制

隨著模型能力提升,企業開始把 agent 部署到跨部門的複雜工作中,讓它們存取專屬資料並代表使用者做決策。素材中直言,agent 找到的用途越多、拿到的存取權限越大,公司就越需要控管與檢查它的行為。這正是 NVIDIA 今日發表 Open Agent Safety Platform(開放式 Agent 安全平臺)的背景,Anthropic 與 NVIDIA 合作,把額外的安全與控制層加進 agent 技術堆疊。

🧩 三層防護:模型內建、Managed Agents 管憑證、OpenShell 管行動

素材描述的防護是分層設計,每一層各自獨立生效,不依賴單一層就能撐住整體安全:

  • 模型內部的安全機制:最底層,來自模型本身的安全設計。
  • Claude Managed Agents:一組可組合的 API,用來大規模建置與部署正式環境等級的 agent。它的 agent 迴圈跑在與沙盒(sandbox,也就是實際執行工作的隔離環境)分開的伺服器上,而密碼、存取金鑰等憑證則存放在獨立的金庫(vault)中,agent 本身完全看不到憑證。Managed Agents 也提供稽核軌跡(audit trail),記錄每個 agent 做過什麼,並能整合企業既有的存取控管系統。企業可以自行帶入沙盒環境,決定運作地點與方式。
  • NVIDIA OpenShell:一套開源的安全執行環境(secure runtime),負責治理與監控所有 AI agent 的行為,並對每個動作執行政策。它的邏輯是「預設全擋,除非規則允許」,會檢查 agent 嘗試使用的每個工具,並對檔案、網路連線與資料存取套用規則。這些規則在 agent 之外強制執行,OpenShell 會記錄每一個允許或阻擋的決策。團隊可以先從最小權限開始,檢視日誌後,再搭配 Claude 逐步收緊規則,朝任務所需的最小存取權限調整。OpenShell 的 policy prover(政策證明器)則用數學證明的方式,確認在團隊撰寫的規則下 agent 究竟能碰到什麼。

💡 Managed Agents 的產品輪廓

根據素材,Claude Managed Agents 目前包含:具備安全沙盒、身份驗證與工具執行的正式環境等級 agent;可自主運作數小時、即使斷線也能保留進度與輸出的長時間 session;能自行衍生並指揮其他 agent 以平行處理複雜工作的多 agent 協作;以及具備範圍化權限、身份管理與執行追蹤的可信治理機制。

素材也提到幾個使用案例:Notion 讓團隊在工作區內把任務交給 Claude,工程師用它出程式碼,其他員工則用來產出網站與簡報,可同時平行執行數十個任務;Rakuten 在工程、產品、業務、行銷、財務等部門跑專屬 agent,每個都在一週內完成部署;Asana 則打造了 AI Teammates,讓 agent 與人一起在專案中承接任務、草擬交付物,並藉由 Managed Agents 更快加入進階功能。

⚠️ 模組化不等於零門檻

素材強調這些防護層是模組化設計,企業可以依自身架構選擇要採用哪些層,這代表落地時仍需要團隊自行評估要接入哪些元件、如何設定沙盒與規則,而非開箱即用的單一方案。

🎯 實務啟示

對正在把 agent 推向正式環境的工程團隊來說,這套架構提供了一個可參考的分工方式:憑證管理與執行環境隔離交給 Managed Agents 這類平臺層,行為層級的白名單與稽核則交給 OpenShell 這種獨立於 agent 之外的執行環境。與其等 agent 出事才補救,不如從「預設全擋、逐步放行」的最小權限模型開始設計,並保留完整的稽核軌跡以便事後追查。

🔗 來源

#Anthropic #Claude #NVIDIA #AIAgents #AgentSecurity #OpenShell #ManagedAgents #EnterpriseAI #AIGovernance #OpenSource

原始資料 Claude Blog · 收集於 2026-09-28
來源原標題
Giving companies more control over their AI agents, with NVIDIA
機構
Anthropic
原始標籤
Agents
原始連結
https://claude.com/blog/giving-companies-more-control-over-their-ai-agents-with-nvidia

摘要原文

Giving companies more control over their AI agents, with NVIDIA Category Agents Product Claude Platform Date September 28, 2026 Reading time 5 min Share Copy link https://claude.com/blog/giving-companies-more-control-over-their-ai-agents-with-nvidia NVIDIA today announced the Open Agent Safety Platform , an open software platform and reference system design for strengthening AI security. Anthropic has collaborated with NVIDIA to bring additional layers of security and control to the agent stack. Claude Managed Agents, a suite of composable APIs for building and deploying production-grade agents at scale, holds the credentials an agent needs in a vault so the agent never sees them. Open source NVIDIA OpenShell software is designed to control what the agent can execute and reach while it works. Customers who are using Managed Agents with OpenShell can limit what an agent can do, review what the agent did and confirm that the limits are in place. Companies are moving from using AI to answer questions to deploying agents that handle complex work across business units, use proprietary data and take actions on behalf of users. As models improve, agents find more uses and get more access. The more access an agent has, the more its company needs to control and check what it does. Protection in layers Protection starts with safeguards inside the model. Managed Agents and NVIDIA Open Shell add limits that sit outside the model and apply to what the agent does. Each layer is designed to enforce its limits independently, so protection doesn't depend on any single layer. The layers are modular, so companies can adopt the ones that fit their setup. Claude Managed Agents does the work and holds the credentials With Managed Agents, the agent loop runs on a separate server from the sandbox, the isolated environment where the work happens. Credentials, meaning passwords and access keys, are held in a separate vault, so the agent never sees them. Managed Agents also provides audit trails, which record what each agent did, and integration with a company's existing access controls. Companies can bring their own sandbox setup and choose where and how it runs. NVIDIA OpenShell sets what an agent can reach OpenShell is open source secure runtime software from NVIDIA. It governs and monitors all AI agent behavior and enforces policies for every action. OpenShell blocks everything unless a rule allows it. It checks each tool an agent tries to use and applies rules to the files, network connections and data the agent accesses. The rules are enforced outside the agent, and OpenShell logs every decision it allows or blocks. Teams can start with narrow permissions, review the log, and use Claude to tighten the rules toward the least access a task needs. OpenShell's policy prover then uses mathematical proof to confirm what the agent can reach under the rules the team wrote. What Claude Managed Agents includes Production-grade agents with secure sandboxing, authentication, and tool execution handled for you. Long-running sessions that operate autonomously for hours, with progress and outputs that persist even through disconnections. Multi-agent orchestration, where agents can spin up and direct other agents to parallelize complex work. Trusted governance, giving agents access to real systems with scoped permissions, identity management, and execution tracing built in. How teams use Managed Agents Notion lets teams hand work to Claude inside their workspace. Engineers use it to ship code, and other employees use it to produce websites and presentations. Dozens of tasks can run in parallel while the team works on the results together. Rakuten runs specialist agents across engineering, product, sales, marketing, and finance, each deployed within a week. Asana built AI Teammates, agents that work alongside people in Asana projects, take on tasks and draft deliverables. Using Managed Agents, the team added advanced features faster than it could have otherwise. Availability Managed Agents is available today. It can operate in a sandbox you control either running on your own infrastructure, or with a managed provider. NVIDIA OpenShell is open source under the Apache 2.0 license and available on GitHub and NVIDIA's developer resources page . No items found. Prev Prev 0 / 5 Next Next eBook FAQ No items found. Transform how your organization operates with Claude See pricing See pricing See pricing Contact sales Contact sales Contact sales Get the developer newsletter Product updates, how-tos, community spotlights, and more. Delivered monthly to your inbox.

由 claude-code/sonnet 自動生成