NVIDIA builds a hardware security layer for AI agents—three.ws has already been guarding every transaction in the software layer

When NVIDIA builds a “trust layer” for AI agents, a Solana project worth $710,000 was already running the same architecture in the software layer.
On September 28, 2026, NVIDIA CEO Jensen Huang posted a tweet on X that shook the entire tech industry: NVIDIA officially launched the Open Agent Safety Platform, together with more than 100 industry partners, to build a “trust layer” for autonomous AI agents. OpenShell runs the agent in a sandbox, while Sentry isolates out-of-bounds agents at millisecond speed in a separate hardware layer. Giants like SpaceXAI, Anthropic, Microsoft, Cisco, CrowdStrike, and Palantir all joined.
But in this discussion about “how to prevent AI agents from going out of control,” one key question was overlooked: when the agent needs to move real funds, who protects the wallet?
The answer may be a Solana project with a market cap of roughly $716,000—three.ws ($THREE). Its developer, Nich (nirholas), previously conducted security research for Apple, Microsoft, AT&T, and the U.S. Department of Defense. Three years ago, while most AI projects were still debating “model alignment,” he was already building the fund-safety layer of an agent economy.
What problem is NVIDIA solving?
NVIDIA’s Open Agent Safety Platform consists of two layers: OpenShell is an open-source security runtime that provides clear, enforceable boundaries for AI agents, tracks their behavior, and applies policies in real time; Sentry is an out-of-band watchdog running on the BlueField-4 DPU. It is fully independent of the CPU and GPU, can monitor the agent’s reasoning in its “thought chain,” and isolates suspicious agents within milliseconds.
NVIDIA corporate VP of AI Justin Boitano said bluntly: “So far, model safety has essentially been about instilling good behaviors into models during training. For probabilistic systems, this approach has obvious limitations. That’s why we introduced a deterministic system to regulate and enforce agent behavior.”
three.ws has already built the same architecture in the software layer.
NVIDIA protects the environment where the agent runs. three.ws protects the funds the agent can move.
The POST /api/agent/guard endpoint of three.ws evaluates every fund-movement call through seven independent mandatory enforcement layers, executed in order:
1. Security blacklist — parameter-level rules that forcefully block known dangerous forms (drain addresses, destructive commands), ignoring any other settings.
2. Human intervention — the tool’s approval policy (never/required/always) combined with a session-approval mode.
3. Capability tokens — check whether the capability tokens that cover the tool are present.
4. Permission level — the agent’s permission level for that tool.
5. Trade guards — automatic execution caps based on hierarchical trade limits, rolling 24-hour and 7-day windows; if exceeded, an automatic execution ceiling that requires manual signatures; MEV slippage throttling; protocol audit query.
6. Spending envelopes — one hard envelope per agent: per-transaction/daily limits, reserve minimums, and a token + destination firewall.
7. x402 budget — an autonomous hourly budget for paid HTTP calls.
Key design: The chain is never short-circuited. All seven layers always run, so the ruling can report “the call blocked by one layer was also seen as risky by another layer,” and more importantly, which layers never evaluated that call. A guard that never ran looks exactly like a guard that passed—this engine treats “blind spots” as a first-class finding, complete with a coverage score.
A set of policies is enforced uniformly across four custody paths—autonomous trading, automated sniping, x402 payments, and owner withdrawals—so that the agent (or a stolen session token) can never go beyond the scope set by the owner.
Developer background: Security isn’t an afterthought—it’s a first principle.
The security architecture of three.ws is not by accident. Its developer, Nicholas Resendez (nirholas), previously conducted security research for Apple, Microsoft, AT&T, and the U.S. Department of Defense. This experience profoundly shaped three.ws’s design philosophy: trust must be proven through cryptography—not rely on centralized authorization workflows. The team he led at three.ws has only 6 people—an elite, engineering-driven team by nature.
three.ws is also a NVIDIA Inception member.
three.ws LLC was accepted into NVIDIA Inception in July 2026—NVIDIA’s global program for startups building in accelerated computing. Every 3D generation pipeline runs on NVIDIA GPUs, including text-to-3D, photo-to-avatar, automated skeletal binding, and motion capture. NVIDIA Inception membership brought three.ws GPU credits, hardware access, and technical guidance for migrating its digital human stack to NVIDIA ACE (Audio2Face + Riva).
Conclusion: environment safety vs. fund safety
NVIDIA is building an operating-system-layer security boundary for enterprise agents—using a sandbox running on the Vera CPU and an out-of-band watchdog called Sentry running on the BlueField-4 DPU, which can isolate out-of-bounds agents within milliseconds.
three.ws is already building a safety boundary for economic behavior layers—seven-layer strategy engine, atomicized execution, blind-spot coverage scoring, and real on-chain simulation.
A machine that protects the agent. The funds that a protected agent can move.
The trust boundary of the hardware layer is here. The boundary of the software layer is already running.
---
$THREE | three.ws
#THREE #Solana #NVIDIA #AgentSafety #x402 #AI #Crypto #Builders
---
⚠️ Disclaimer: This article is for reference only and does not constitute investment advice. $THREE is a low market-cap, high-volatility asset. Please do your own research and manage your risks.