Confidential Computing as an Additive Inference Serving Profile#
Secure Agent Workspace can integrate with multiple governed inference-serving profiles. Backends may run inside the same cluster or behind approved managed endpoints. Either Phase I or Phase II workspaces may use the confidential path when authorized. Confidentiality is a serving-profile choice, independent of workspace control maturity.
Standard inference service. This path serves open models or models that do not require attestation-gated protection from the infrastructure operator. It can be implemented as an approved NVIDIA NIM microservice, a vLLM inference server, an enterprise LLM gateway, or a general inference gateway. NIM and vLLM provide the model-serving runtime. A gateway can front one or more of those runtimes, internal model services, or approved external endpoints and provide a stable API together with model routing, authentication, quotas, rate limits, request policy, usage accounting, and audit metadata. The gateway is optional: an Agent Workspace VM may call an approved NIM or vLLM endpoint directly, or it may call a governed gateway that selects an allowed backend according to enterprise policy. In either form, the workspace reaches the service through a capability-brokered, allowlisted inference API; raw provider credentials do not enter the agent process. This path does not require attestation-based model-secret release, although normal transport encryption, access control, data-handling policy, and content-safe logging remain required.
Confidential computing inference service. A proprietary model is distributed as an encrypted container image and served from an NVIDIA Confidential Container. The confidential pod combines a Kata confidential VM, a CPU Trusted Execution Environment (TEE), and an NVIDIA GPU operating in Confidential Computing mode. Model decryption occurs only after the CPU and GPU execution environment satisfies the configured attestation policy. NVIDIA documents this Kata, Trustee, GPU attestation, and encrypted-image pattern in the NVIDIA Confidential Containers Reference Architecture.
Both paths remain inference services, separate from the workspace runtime. Each workspace can call either path according to model policy and workload requirements. The confidential path can protect the selected assets from actors outside its declared trusted computing base; it does not make the agent workspace itself confidential.
An enterprise may expose both paths through a common LLM or inference gateway so Agent Workspace clients use one stable API contract. The gateway can route requests according to approved model, data classification, user authority, residency, cost, and workload policy. The agent should not be able to select an unapproved backend or bypass the gateway’s policy decision simply by changing a model name or endpoint.
The gateway’s data-plane behavior must match the selected serving profile:
For standard inference, the gateway may terminate, inspect, transform, log, or route requests according to enterprise data-handling policy.
Where inference-data confidentiality is claimed, protection must extend from the trusted workspace-side client or proxy into the attested inference workload and back to the trusted client. A gateway or DPU-hosted service outside the trusted computing base must not decrypt protected requests or responses. Inspection or termination requires a trusted placement or a design preserving that confidentiality property.
Selecting a confidential backend alone does not establish inference-data confidentiality across the complete path. For that profile, requests remain encrypted until they reach the attested workload, and endpoint identity, model identity, serving profile, routing decision and attestation state remain auditable without recording protected content. Retained data outside that boundary needs its own encryption, access, integrity and recovery controls.