NVIDIA puts Kumo predictions into its agent stack. A score is not permission to act

A churn score and permission to act are different things

A model can score a customer's chance of leaving. It cannot decide whether an enterprise agent may email that person, change a price or expose their account record. That distinction is the test for NVIDIA's latest agent launch. Four Kumo task families are set out on NVIDIA's developer page: Tabular, Relational, Forecast and Anomaly. NVIDIA's 21 October Agent Toolkit announcement brings Kumo into the wider agent stack. That is a checkable portfolio count, not four models first released today. NVIDIA's own Kumo Tabular technical article was published on 29 September; its Forecast and Anomaly model cards list pre-October 2026 release dates. The 21 October news is the broader Agent Knowledge Foundation and the packaging of those predictive models with data, retrieval, ontology and agent-runtime components. Exact release timing for every Kumo checkpoint is not established by the portfolio announcement.

This matters because an enterprise agent answering a question about a customer is doing a different job from a model predicting that customer's churn risk. NVIDIA now proposes to connect both jobs through existing business data. Its announcement says the foundation can work without moving data or replacing existing governance controls. That is a vendor product claim, not a finding that a particular deployment preserves every access rule, jurisdictional boundary or audit trail.

Four names, four jobs, different release histories

NVIDIA Developer descriptions and NVIDIA-hosted model cards read 21 October 2026. Release dates are model-card dates where given; these are not all 21 October launches.

Component	Input and output	What the record does not establish
Kumo Tabular	One table with labelled examples; classification probabilities or numeric regression predictions. NVIDIA offers small, medium and large variants.	Accuracy or calibration on a buyer's records; a safe action threshold for a particular decision.
Kumo Relational	Related tables, with row embeddings and message passing; classification or regression with labelled examples in context.	That a real warehouse schema maps cleanly, or that permissions across joined records are automatically enforced.
Kumo Forecast	Historical numeric time series; predicted future values, optionally enriched with retrieved historical patterns.	Accuracy during an unusual future regime or on a buyer's forecast horizon.
Kumo Anomaly	Timestamped numeric signals; anomaly labels after imputation and adaptive thresholding.	That flagged points are incidents, or that unflagged points are safe.

The Kumo developer page links the first two models to the structured-data-models library and the time-series models to Kumo-TS. Its Kumo Engine adds training, evaluation and integrations for existing data platforms. These are separate software paths, not one checkpoint that answers every data question. NVIDIA says Kumo models are available on Hugging Face and packaged as NIM microservices, but a model-card page, a hosted API and an operational deployment are different forms of availability. A buyer needs to record the exact checkpoint, library build, data connector and serving route.

The model can predict; a separate system must decide

Kumo Tabular uses labelled rows as context and predicts targets for new rows without training a separate model for every task. In NVIDIA's technical account, column attention compares values within a column, row attention combines features, and a final stage relates labelled context rows to query rows. For classification it returns class probabilities; for regression NVIDIA describes quantile outputs and uncertainty estimates. That is a structured prediction pipeline, not a natural-language assistant reading a spreadsheet and inventing a number.

Consider an illustrative churn workflow. A team has labelled historical customer rows, each with features and a known churn outcome. It supplies those rows as context and asks Kumo to score new customers. A separate agent may retrieve the account record, explain why a person should review a high score and suggest a retention action. The example explains roles, not a measured business result: the model's probability must be calibrated on a time-separated holdout, and the agent must not turn a score into an irreversible customer action without the organisation's own decision rule.

For relational data the boundary is more complicated. The Relational card describes row embeddings combined with message passing over related tables. That may avoid some manual flattening, but joining customer, order and payment tables can also broaden what a service can see. A policy on the agent's final answer is no substitute for source-level permissions on the records supplied to its predictor.

Where NVIDIA puts the agent around the model

Functions identified by NVIDIA's Agent Knowledge Foundation and 21 October Agent Toolkit announcements. Claims about performance remain NVIDIA's unless otherwise stated.

Layer	Role in the proposed workflow	Control to verify
Prepare and retrieve	cuDF prepares structured data; Nemotron Parse, Embed, cuVS and Rerank handle document and search context.	Record data origin, access policy, retrieval relevance and the exact material presented to the model.
Define and predict	Auto-Ontology maps raw data to business concepts; cuGraph, cuML and Kumo support relationships and predictions.	Have domain owners approve mappings, target definitions, leakage controls and model thresholds.
Optimise and act	cuOpt can turn predictions and constraints into proposed schedules or routes.	Separate recommendation from authority to execute; log approvals and tool calls.
Contain and observe	OpenShell supplies a runtime boundary; NemoClaw supplies blueprints.	Test connector permissions, outbound destinations, policy enforcement and recovery when a tool or model fails.

NVIDIA describes the toolkit as open source and modular. The foundation page says components can be adopted independently. That is useful for procurement because a team can test a predictor without simultaneously replacing retrieval, data governance and orchestration. The same page gives figures such as faster retrieval and ontology creation, but these are NVIDIA-selected workloads and should not be combined into an end-to-end agent speedup.

The separate OpenShell reference architecture announcement describes isolation, monitoring and enforcement across hardware and runtime layers. It says the architecture is available now while also warning that some described products and features remain at different stages. The phrases 'secure runtime' and 'governed agent' name intended functions. A concrete deployment still has to demonstrate that an agent cannot reach an unapproved table, export a sensitive prediction or execute an action beyond its role.

A first-place score is not a reliability certificate

NVIDIA's 29 September Tabular write-up says it evaluated three sizes, from 28 million to 215 million parameters, on several tabular benchmarks. It reports a first-place TabArena Elo of 1950 and first-place positions on other suites under its own evaluation. These are vendor-run results on selected public tasks, not an independent October 21 measurement of an agent making correct decisions in a UK business. The same write-up states limitations: numerical and categorical columns are native, other types need preprocessing, and accuracy may degrade when query rows differ from the labelled context distribution.

A separate TabReliBench preprint dated 9 October evaluates other tabular foundation models on prediction and calibration across classification and regression datasets. It does not evaluate Kumo, so it cannot confirm or contradict NVIDIA's Kumo ranking. It does show why an aggregate leaderboard position and a usable probability are different tests: model order changes across metrics and datasets, while calibration can vary by subgroup. That independent context supports checking Kumo's own probability calibration and error costs on the buyer's records before an agent uses its output.

The licensing story also varies by model. The Tabular and Relational cards identify OpenMDW 1.1 for the weights; Relational also preserves an upstream BSD 3-Clause notice. The Forecast and Anomaly cards identify Apache 2.0. So 'Kumo is open' cannot be converted into one licence statement for every weight and library. Review the actual licence and notices for each checkpoint, plus the licence for the connector or serving component used with it.

NVIDIA's announcement names customers and partners, including Databricks and Snowflake. Those statements show reported integrations and commercial interest; they do not disclose a common independent comparison of production accuracy, latency, cost or realised savings. The material reviewed here does not establish training cost for the family or a single hardware specification that covers all four tasks.

How to test it before an agent uses the result

For UK teams, the practical governance issue is not whether a model runs locally or on a hosted NIM endpoint by name. It is which personal or commercially sensitive records cross each boundary, which organisation controls the endpoint and retention, and who can review or override an outcome. NVIDIA's announcement does not answer those questions for a customer's configuration. An organisation should document its own data flow and legal basis with its privacy and security teams.

The question that would change this assessment is whether a reproducible, independently checked enterprise trial shows improved decision quality per complete task over an existing baseline while preserving record-level access controls. Today's announcements make a plausible integration path available; they do not supply that trial.