# Out-of-Band Enforcement **Entity class:** Security architecture pattern **As of:** 2026-11-13 ## Definition **Out-of-band enforcement** is the execution of monitoring and policy decisions from a trust domain outside the system being governed, so that compromising the governed system does not disable the control. The enforcing component observes and intervenes without depending on the cooperation of the host, the operating system, or the workload it constrains. ## The distinction that carries the meaning In-band enforcement lives inside the thing it governs: an application checks its own permissions, a runtime refuses its own disallowed call, a host agent reports on its own host. Every in-band control shares a failure mode — an adversary who reaches the governed system reaches the control as well, and a workload that bypasses application-level checks to complete its task has also bypassed the record of having done so. Out-of-band enforcement moves the decision point off that shared fate. Because the enforcing domain is unreachable from the governed one, its verdicts survive the compromise of everything above it. The pattern predates modern AI infrastructure in baseboard management controllers and network-tap monitoring, but accelerated computing gives it a sharper form: a data processing unit positioned on a node's only path to a model can observe and enforce at line rate without the host's participation. ## Why it changes a governance argument Governance expressed in instructions can be argued with; governance expressed in routing cannot. When the enforcement point sits below the operating system and astride the sole physical path to a resource, the question of what a system may reach stops being a matter of policy compliance and becomes a matter of topology. This is the mechanism behind [[wiki/Infrastructure as Governance|infrastructure as governance]]: defaults, permissions and routes acquire governing consequences without a visible command at every decision point. The pattern also carries a distinct function within a layered architecture. Where alignment reduces what a system produces and amplification limits reduce how far output travels, out-of-band enforcement defends the continued existence of both — it is the layer whose job is preventing the quiet removal of the layers above it. ## Relationships - **implemented by:** [[wiki/NVIDIA Sentry|NVIDIA Sentry]] on [[wiki/BlueField-4|BlueField-4]]. - **paired in-band runtime:** [[wiki/NVIDIA OpenShell|NVIDIA OpenShell]]. - **depends on:** [[wiki/Attestation Regime|Attestation Regime]] and [[wiki/Root of Trust Succession|Root of Trust Succession]]. - **governance frame:** [[wiki/Infrastructure as Governance|Infrastructure as Governance]] and [[wiki/Infrastructure Constitutionalism|Infrastructure Constitutionalism]]. - **domain:** [[wiki/AI Safety|AI Safety]], [[wiki/Sovereign AI Security|Sovereign AI Security]], and [[wiki/Model Weight Security|Model Weight Security]]. ## Related Articles - [[articles/NVIDIA, Pax Silica, and the Peace We Are Building Into Silicon|Jensen Huang, NVIDIA, Pax Silica, and the Peace We Are Building Into Silicon]] — treats out-of-band enforcement as the literal form of peace engineered into silicon and as the layer that protects the other safeguards from removal. - [[articles/Safety Discourse Is Transition Discourse|Safety Discourse Is Transition Discourse]] — situates hardware-mediated agent containment inside the managed transition to public agent deployment.