Palo Alto Networks laid out five areas of work with NVIDIA in support of the NVIDIA OpenShell Reference Architecture: an AI gateway on Vera CPUs, runtime protection on BlueField DPUs, agent identity governance on NVIDIA Sentry, signals into an AI-driven SOC, and partner services. The argument under the product list is the part worth keeping. “Agents can be steered past their guardrails, and a compromised host cannot be trusted to accurately report what occurred.” If the host can lie, the controls have to live somewhere the host cannot reach, and the post’s answer is the DPU.
Read the tenses before reading the claims. AI Runtime Security on BlueField is described as generally available. The identity integration is not: Palo Alto says it is “advancing” one, and that “once available” it will deliver zero-trust protection and tamper-resistant auditing. The post’s “increased token throughput” carries no number, and “comprehensive security across every layer of the AI factory” is a vendor’s sentence. What survives is the separation itself, plus a clean statement of the problem: “Runtime protection answers what an agent is doing. Identity governance helps determine whether it is authorized to do it.” The stated goal, a verifiable identity for each agent, access appropriate to its task and attributable actions, holds up whichever vendor ends up selling it.
The catalog can test how much of this an outside developer or agent can see today. Palo Alto Networks is an enormous API estate, with 599 API pages, and the catalog description lists Cortex XSIAM among the products on its developer platform. Yet no API page in that list carries Cortex, XSIAM or runtime in its name, so this announcement has no obvious page to land on. The nearest named surface is the AI Sec Profile API. That is a limit of what we can match by name, not proof that nothing exists, and the bulk of the announcement is infrastructure rather than interface. Enforcement in silicon does not need a public endpoint. A governance story that wants to be checked eventually does.
The Kin Score is 75.3, exemplar, and this is a company that earns it: developer ergonomics at 85.7, contract governance at 79.1, discoverability at 78.6. Access clarity, at 40.0, is the outlier. Agent Readiness is 48.6, and its lit dimensions are real ones, including auth clarity, error semantics, reversibility and a dry-run mode. The agentic access profile records 3,923 operations, 1,883 of them acting and 55 flagged human-in-the-loop. Now read the unlit list against the post’s thesis: delegated identity, consent identity, protected resource metadata, dynamic client registration and agent card are all dark. Palo Alto is writing plainly about whose authority an agent carries, and the record cannot yet find, at its own front door, how an agent would present that authority.