Built on open standards. Enforced where it counts.

NVIDIA OpenShell

Identity aware sandboxes for every agent.

NVIDIA OpenShell is an open source runtime for running AI agents in sandboxes with minimal default access. OATHERA connects identity to that sandbox: when an approved agent starts, its operational boundary becomes the sandbox policy that governs which paths it can read and write, which hosts it can reach, and which privileges it holds. Because OpenShell enforces those limits outside the agent, a compromised or misdirected agent cannot talk its way past them. Every sandbox event is tagged with the agent's OATHERA identity and owner, and flows into the control plane.

Key points: boundary derived sandbox policy · filesystem confinement via Landlock · policy enforced egress · agent identity on every sandbox log · revoke the identity, stop the sandbox.

Open Policy Agent (OPA)

Fine grained authorization, written as code.

OATHERA passes OPA a verified input document for every request: the agent's identity, owner, boundary, task and the exact operation and resource requested. Your Rego policies decide. Because the input is cryptographically verified first, policies reason about facts, not claims. Decisions are logged with the policy version that made them.

Key points: verified identity as policy input · Rego policies in Git · per request decisions · decision logs into the control plane · bring your existing OPA bundles.

OIDC and SPIFFE

Fits the identity fabric you already have.

OATHERA federates with OIDC providers for owner sign in and approval, and maps agent identities to SPIFFE IDs so agents can participate in service mesh and workload identity trust domains.

Telemetry exports

Your data, in your tools.

Stream OATHERA events, decision logs and traces to your SIEM and observability platforms through OpenTelemetry and standard log formats. Specific SIEM and agent framework integrations will be listed here as they ship.