How to Deploy Trustworthy Specialized AI Agents with SAP and NVIDIA

Introduction

Specialized AI agents are transforming enterprise operations—from finance and procurement to supply chain and manufacturing. However, as these agents move from assistants to autonomous actors, trust becomes critical. Agents that touch systems of record, cross application boundaries, and operate without constant human oversight need strong boundaries, policy enforcement, and audit trails. That's where the collaboration between SAP and NVIDIA comes in. By embedding NVIDIA OpenShell, an open-source runtime for secure AI agent development, into the SAP Business AI Platform, enterprises can run specialized agents with the security and governance controls required for production. This guide walks you through the essential steps to deploy trustworthy specialized AI agents using this powerful combination.

What You Need

• SAP Business AI Platform – The enterprise platform for building and managing AI agents, including Joule Studio for custom agent development.
• NVIDIA OpenShell – An open-source runtime that provides isolated execution environments, policy enforcement, and infrastructure-level containment.
• Enterprise identity and access management (IAM) system – For integrating roles, permissions, and data boundaries.
• Audit and monitoring tools – To track agent actions and ensure compliance.
• Knowledge of your business processes – Understanding of finance, procurement, supply chain, or manufacturing workflows where agents will operate.
• Development and operations team – Engineers familiar with SAP, NVIDIA technologies, and agentic AI.

Step-by-Step Guide

Step 1: Define Trust Requirements for Your Agents

Before deployment, map out what trust means for your enterprise. Consider:

• Data boundaries – What data can the agent see? What is off-limits?
• Action permissions – Which actions can the agent perform without human review? Which require approval?
• Process controls – How does the agent fit into existing workflows (e.g., procurement approvals, supply chain adjustments)?
• Identity integration – How will the agent authenticate and authorize across systems?
• Audit trail – What logs and records are needed for compliance?

Document these requirements—they will guide every subsequent step.

Step 2: Set Up SAP Business AI Platform with OpenShell

Work with your SAP team to ensure the SAP Business AI Platform is configured to leverage NVIDIA OpenShell. The platform now embeds OpenShell as the runtime security layer for all SAP AI agents. Contact SAP support or your account representative to enable OpenShell integration. If you are using Joule Studio (SAP's environment for building and managing end-to-end enterprise agents), ensure it is updated to support custom agents that will run under OpenShell's governance.

Step 3: Configure OpenShell Execution Environments and Policies

OpenShell provides isolated execution environments. For each agent, define:

• Isolation containers – Restrict the agent to a specific runtime environment with limited network and filesystem access.
• Policy enforcement – Set rules at the filesystem and network layers. For example, an agent handling finance data should not access supply chain systems unless explicitly allowed.
• Infrastructure-level containment – Ensure that if an agent's logic fails, damage is contained and cannot spread to other parts of the enterprise system.

Collaborate with your security team to align these policies with your existing governance framework.

Step 4: Integrate Enterprise Identity and Permissions

Agents must operate within the same identity and permission boundaries as human users. Integrate your IAM system with SAP Business AI Platform and OpenShell. This ensures that agents inherit roles, permissions, and data access controls. For example, a procurement agent should only see purchase orders that the corresponding human buyer would be allowed to view. NVIDIA and SAP engineers have co-developed OpenShell to include hooks for enterprise identity integration—use these hooks to bind agent actions to real user roles.

Step 5: Build and Test Your Agents in Joule Studio

Using Joule Studio, create your specialized agent. Because OpenShell is already the runtime security layer, every agent you build automatically gets policy enforcement and isolation. While building, keep the trust requirements from Step 1 in mind. Test the agent in a sandbox environment before moving to production. Validate that its actions comply with the defined policies, that it cannot exceed its boundaries, and that all actions are logged for audit.

Step 6: Apply Auditing and Governance Hooks

OpenShell includes built-in hooks for auditing and governance. Configure these to export logs to your enterprise audit system. Every action the agent takes—every system it touches, every record it modifies—should be recorded. This audit trail is essential for compliance and for building trust with stakeholders. Regularly review logs to detect anomalies or policy violations.

Step 7: Deploy to Production and Monitor

Once testing is complete, deploy your agent to production. Start with a limited scope—perhaps a single process in one department. Monitor its behavior closely. Use the audit logs to verify that policies are being enforced. Gradually expand the agent's scope as confidence grows. Remember the five-layer cake analogy from NVIDIA's CEO: applications sit on top of chips, infrastructure, and models. Your business applications are where value is created, so ensure the trust layer (OpenShell) is functioning correctly.

Tips for Success

• Collaborate with technology providers: Both SAP and NVIDIA offer expertise in agentic AI governance. Engage with them early—especially since SAP engineers are actively co-developing OpenShell and can provide best practices.
• Start small, scale gradually: Don't deploy a fully autonomous agent across all systems at once. Pilot in a controlled environment, learn from the audit data, and iterate.
• Involve business process owners: Agents that touch finance, procurement, or supply chain need input from the teams that own those processes. They understand the subtleties of roles and permissions.
• Keep the open-source community in mind: OpenShell is open source. Contributing back your own policy models or runtime hardening improvements can help the entire ecosystem—and you'll benefit from community enhancements.
• Educate your organization: The shift from AI assistants to autonomous agents changes the trust equation. Make sure your team understands that agents need boundaries, policy enforcement, and audit trails. This is not just an IT project—it's a cultural shift.
• Align with the broader NVIDIA and SAP collaboration: As a longtime SAP customer itself, NVIDIA understands enterprise governance needs. Leverage shared context by using common frameworks for identity and data boundaries.