Hardware-backed AI controls target data custody and agent authority separately

Its client verifies signed evidence about the hardware and software environment before releasing a sensitive request, and refuses transmission if the environment fails the configured policy. Requests stay encrypted through intermediaries and are decrypted inside the attested boundary. [1][4]

NVIDIA’s October 21 Confidential Bare Metal announcement addresses custody on dedicated third-party infrastructure through platform-integrity checks and hardware access restrictions. Its technical documentation keeps the infrastructure owner outside the runtime trust boundary, but trusts the tenant’s software and administrators: it does not protect downstream users’ data from that tenant. Protection depends on the deployed configuration. [2][5]

A separate NVIDIA design, Sentry, puts policy enforcement and runtime observation in a BlueField-4 hardware domain outside the agent’s host software. The October 21 technical account says availability is planned for early 2027; existing DOCA components support earlier experimentation. A reference architecture is not evidence that a customer deployment has achieved its promised protection. [3][6][7]

These controls answer different questions. Confidential inference reduces who can see a workload’s plaintext. Agent enforcement limits which actions it may take. Neither replaces application permissions, a suitable security policy or the obligations attached to the data. Ask a supplier to demonstrate the exact boundary, attestation behavior and failure response that will be deployed. [1][2][3][5]