FOUR VIEWS / ONE ARCHITECTURE
ZettaShell, Illustrated
An animated field guide to the components, boundaries, channels, and identities behind governed agent execution.
Architecture Overview
Trace the control plane, workload isolation, approved egress, and the policy-approval loop.
Extending NVIDIA’s Secure FrameworkInside the Sandbox Boundary
Placement belongs to the driver; policy decisions belong to the supervisor. The sandbox manages workload processes through the isolation interface.
Extending NVIDIA’s Secure FrameworkMediated Channel
Separate streams share one protected connection. The amber pause illustrates backpressure on a single TCP stream while other traffic continues.
Extending NVIDIA’s Secure FrameworkHow Components Authenticate
Credentials are tied to the sandbox runtime identity. Gateway calls use supervisor credentials, separate from user authentication.
Extending NVIDIA’s Secure FrameworkZETTASHELL / ENTERPRISE FABRIC
The Total Enterprise Fabric
for Autonomous AI
ZettaShell transforms autonomous AI from an unmanageable risk into an auditable, extensible, and highly-available enterprise capability.
