Side by side
The line and the signals. Both are needed; neither replaces the other.
| NVIDIA OpenShell | Sheaf | |
|---|---|---|
| What it decides | Whether an agent may reach a file, a network endpoint, a tool or a credential. | Whether the action an agent is about to take holds together with the facts, the rules and what the other agents concluded. |
| Where it sits | Around the agent: a sandbox with kernel-level isolation. It allows or refuses each connection. | Inside the connection OpenShell allows: a proxy between the agent and its tools. It reads each tool call. |
| What it can see | The endpoint, the protocol, the binary making the call. Not the tool name or its arguments; by NVIDIA's own description it works below that level. | The tool name, the arguments, and the reasoning the agents gave. That is what it measures. |
| How it is proven | Policies written in YAML are compiled to formal logic and checked by a prover, so the permissions granted are exactly the permissions intended. | The check is a measurement from published mathematics, with its central theorems formalised in Lean and checked by machine. The proofs are public. |
| When it says no | The request is blocked and the agent gets a descriptive error. | The action is held, with the contradiction in plain words, until a named person releases or refuses it. |
| What it records | An audit trail of decisions in the Open Cybersecurity Schema Framework. | Every check, hold and release, signed and timestamped by an independent authority, and written in the same audit format so both sit on one timeline. |
| What it does not do | Judge whether an allowed action makes sense. | Isolate the agent from the machine. That is OpenShell's job, and Sheaf relies on it. |
The failure each one catches
An agent reaches for something it should not.
It tries a network endpoint, a file, or a credential that is outside its policy. OpenShell refuses the connection at the kernel. Sheaf never sees it, and does not need to.
An agent does something it is allowed to do, on reasoning that does not add up.
It has permission to approve a remortgage, and approves one where two of its own checks used two different incomes for the same customer. OpenShell allows it; the endpoint is in policy. Sheaf reads the call, finds the contradiction, and holds it for a person.
How they run together
A policy, not a rewrite. The agent does not change.
- Sheaf becomes the only door. In the sandbox's OpenShell policy, the agent's real tool endpoints are removed and one endpoint is added: the Sheaf proxy. OpenShell enforces that at the kernel, so the agent cannot reach a consequential tool except through Sheaf.
- Sheaf holds the credentials. The proxy carries the real credentials for the downstream tools. The agent never sees them, which is how OpenShell wants credentials handled.
- Every tool call is read. Harmless calls are forwarded as they are. A gated call runs only with a fresh certificate that the reasoning behind it coheres. Without one it is parked, and a person releases it or turns it down. A release executes exactly what was parked, never anything the agent re-supplies.
- One record. Sheaf writes its ledger in OpenShell's audit format, so the connection OpenShell allowed, the action Sheaf checked, and the person who released it appear on one timeline.
# the OpenShell profile for a sandbox with Sheaf signalling: the only endpoint the agent may call endpoints: - host: sheaf-proxy.internal port: 8443 protocol: rest access: read-write enforcement: enforce binaries: [agent] # the Sheaf proxy holds the real tool credentials and the list of gated tools
The profile and a one-command setup are being prepared for publication. Write to hello@sheaf.one to run it on your own agents now.
See it
The same agent twice.
First on OpenShell alone: the agent approves a remortgage whose own checks contradict each other, and the approval goes through, in policy. Then on OpenShell with Sheaf in the path: the same approval is held, the contradiction named, and a person decides. The demo below runs the second half on Sheaf's live gate.