Overview
The Swif OpenShell Inventory Policy collects an inventory of NVIDIA OpenShell on managed macOS and Linux devices. For each user on the device, it reports:
OpenShell installs, including the OpenShell version
Gateways, the OpenShell services that run and manage sandboxes
Running sandboxes, including the AI agent in each one and its container image digest
The active policy hash, a fingerprint of the sandbox policy in force
Use it to find out where OpenShell is used across your fleet, which agents run in sandboxes, and whether those sandboxes run the policy you expect.
This policy only collects information. It doesn't install OpenShell, change sandboxes, or block anything.
Requirements
Requirement | Details |
Operating systems | macOS and Linux |
Device ownership | Company-owned and BYOD |
Swif agent | |
OpenShell | Not required. On devices without OpenShell, each user is reported as OpenShell not installed. |
Not covered: Windows. OpenShell runs on Windows only inside WSL 2, so the agent doesn't collect an OpenShell inventory there.
Settings reference
Setting | What it does | Default | Range |
Enabled | Turns OpenShell inventory collection on or off. | Off | — |
Collection Interval (Minutes) | How often, in minutes, the agent collects the inventory. | 60 | 30–1,440 |
A shorter interval keeps the inventory more current. A longer one uses fewer device resources. The 60-minute default suits most organizations.
What's collected
Item | What it tells you |
OpenShell install | Whether OpenShell is installed for each user, and which version |
Gateway | Each OpenShell gateway that manages sandboxes on the device |
Sandbox | Each running sandbox and the AI agent inside it |
Image digest | A unique fingerprint of the sandbox's container image. Two sandboxes with the same digest run exactly the same image. |
Active policy hash | A fingerprint of the sandbox policy in force. Matching hashes mean the same policy. |
Inventory is reported for each local user, including the user's local username, so you can see who runs each install and sandbox. Users without OpenShell are reported as OpenShell not installed, with no gateways or sandboxes.
Common uses
Find OpenShell across your fleet. See which devices and users have OpenShell installed, including installs IT didn't know about. You can filter the device list to show only devices with OpenShell.
Check versions. Find devices that need an OpenShell update before you roll out features that need a newer version, such as the Swif OpenShell Sandbox Policy, which needs OpenShell 0.1 or later.
Check which agents run in sandboxes. See whether developers run Claude Code, Codex, or other agents inside OpenShell.
Confirm sandboxes run the expected policy. Compare active policy hashes across devices. A sandbox with a different hash runs a different policy, for example one that started before your latest change.
Track images. Use image digests to spot sandboxes built from unapproved or outdated images.
Before you start
Deploy the Swif Agentic Security agent to the devices.
Tell users what's collected, especially on BYOD devices. The inventory includes each local user's username, along with the OpenShell installs and sandboxes that user runs.
Choose a pilot group of devices.
Create the policy
In Swif, go to Agentic Security > Policies.
Select Swif OpenShell Inventory Policy.
Turn on Enabled.
Set Collection Interval (Minutes), or keep the 60-minute default.
Assign the policy to your devices and save.
The first inventory appears after the agent receives the policy and completes a collection.
Example configurations
Example 1: Fleet-wide discovery
Setting | Value |
Enabled | On |
Collection Interval (Minutes) | 1440 (once a day) |
Assign to every macOS and Linux device to find where OpenShell is used, with minimal device overhead.
Example 2: Teams using OpenShell sandboxes
Setting | Value |
Enabled | On |
Collection Interval (Minutes) | 30 |
Assign to devices that also have the Swif OpenShell Sandbox Policy, so you can quickly confirm sandboxes run the current policy after you change it.
Verify the policy
Confirm that the device is online and the policy shows as applied.
On a test device, start an OpenShell sandbox.
Wait for the policy to reach the device, then for Collection Interval (Minutes) to pass.
In Swif, check the device's OpenShell inventory. Confirm that it shows the install, gateway, and running sandbox.
Troubleshooting
The inventory is empty
Check that Enabled is on and the device is online.
Check that the Swif agent is running.
Wait for Collection Interval (Minutes) to pass after the policy reaches the device.
If each user shows OpenShell not installed, the inventory is working, and OpenShell isn't installed for those users.
A running sandbox doesn't appear
Sandboxes started after the last collection appear at the next collection. Wait for Collection Interval (Minutes) to pass, or lower the interval.
Windows devices show no inventory
This is expected. OpenShell runs on Windows only inside WSL 2, which this policy doesn't cover.
Sandboxes show different policy hashes
The sandboxes run different policies. A sandbox may have started before your latest filesystem change, or someone may have changed its policy on the device. If you use the Swif OpenShell Sandbox Policy, check its drift reports.
Related resources
Swif
NVIDIA