NemoClaw Network Policy — Tiers, Presets & Approvals

What the sandbox can reach by default

• Files: read-write to /sandbox and /tmp; read-only to system paths such as /usr, /etc and /app. The agent runs as a dedicated sandbox user.
• Network, baseline: only what the agent itself needs. For OpenClaw that's NVIDIA inference, ClawHub, openclaw.ai, OpenClaw docs and read-only npm for plugin installs. GitHub and every messaging platform are not in the baseline. Enable a channel during onboarding or add its preset.
• Model providers: external providers such as Anthropic, OpenAI and OpenRouter are reached through the OpenShell gateway, not directly from the sandbox. The agent never holds your provider keys.
• SSRF protection: even for an allowed host, OpenShell blocks connections that resolve to loopback, private, link-local or cloud-metadata addresses.

Policy tiers (picked during onboarding)

The onboarding wizard asks for a tier. The baseline always applies, and the tier decides which presets go on top:

A second screen lets you include or exclude individual presets and switch each between read-only (GET) and read-write access. For scripted installs, set NEMOCLAW_POLICY_TIER=balanced|restricted|open|personal.

1. Add a maintained preset (recommended)

NVIDIA maintains reviewed presets for common services. They merge into the running sandbox's policy, with no restart:

nemoclaw my-assistant policy list                 # what's available and what's applied
nemoclaw my-assistant policy add github --dry-run # preview endpoints, methods and binaries
nemoclaw my-assistant policy add github --yes
nemoclaw my-assistant policy remove github --yes

Run policy add with no name for an interactive picker. Run the same command again after a preset changes, and NemoClaw applies only the difference. Maintained presets include:

Don't use openshell policy set to add access. It replaces the whole live policy instead of merging. policy add is the merge.

2. Approve a blocked request, just for this session

When the agent hits an endpoint that isn't allowed, OpenShell blocks it and shows it in the terminal UI with the host, port, requesting program, and method and path:

openshell term

Select the sandbox (j/k, Enter), press r for Network Rules, then press a to approve or x to reject the selected request. A approves everything pending. Approvals last only as long as that sandbox instance. They're gone when the sandbox is recreated and never written to a policy file, which makes this the right tool for "is this what's failing?". To make access permanent, use a preset.

3. A custom preset for a service NVIDIA doesn't cover

Write a preset file that names the exact host, the allowed methods and paths, and the one program allowed to use it. Take the program path from the blocked request in openshell term:

# presets/my-service-api.yaml
preset:
  name: my-service-api
  description: "Reviewed external service"
network_policies:
  my-service-api:
    name: my-service-api
    endpoints:
      - host: api.example.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
    binaries:
      - { path: /path/to/requesting-binary }

nemoclaw my-assistant policy add --from-file ./presets/my-service-api.yaml --dry-run
nemoclaw my-assistant policy add --from-file ./presets/my-service-api.yaml --yes
nemoclaw my-assistant policy remove my-service-api --yes

NemoClaw rejects catch-all hosts (*, 0.0.0.0/0) and hand-written allowed_ips. For a service on your private network, pass --trusted-private-host <host> and check the addresses it pins in the dry run. Review every custom preset, especially ones from outside your team, because they skip NVIDIA's review.

4. Change the baseline for every future sandbox

For access every new sandbox should have, edit the baseline in a NemoClaw source checkout on the host: nemoclaw-blueprint/policies/openclaw-sandbox.yaml for OpenClaw, or agents/hermes/policy-additions.yaml for Hermes. Then run nemoclaw onboard again. Changes made only inside a sandbox are lost when it's recreated.

Inspecting and trimming the policy

nemoclaw my-assistant policy get > current-policy.yaml   # live base policy, credentials redacted
nemoclaw my-assistant policy explain                     # plain summary: allowed, blocked, how to request more
nemoclaw my-assistant policy exclude <key> --dry-run     # remove one baseline entry, with impact preview
nemoclaw my-assistant policy restore <key> --dry-run

policy explain also writes a summary into the sandbox (/sandbox/.openclaw/workspace/POLICY.md for OpenClaw). When something is refused, the agent can then tell whether it was blocked by policy, missing approval or unsupported, instead of retrying blindly.

Common cases

• Telegram or Discord stopped answering after a rebuild: run policy list. If you didn't re-select the channel during onboarding and its token is no longer in the environment, NemoClaw treats the channel as disabled and removes its preset. Add it back with nemoclaw my-assistant channels add telegram, which configures the channel and its preset together.
• Package installs fail even with the host allowed: a download may redirect to a CDN that isn't allowed. NVIDIA recommends installing the tool when the image is built (nemoclaw onboard --from <Dockerfile>) rather than opening more egress at runtime.
• The agent needs a service running on your host: expose it on a host IP the OpenShell gateway can reach and add a custom preset with --trusted-private-host. Don't rely on host.docker.internal.
• Gmail: the gmail preset covers IMAP/SMTP with an App Password stored inside the sandbox, where the agent can read it. Create a dedicated App Password, and revoke it when the task is done.

Official references: NemoClaw docs (Network Policy section) and the OpenShell policy schema. For the rest of the setup, see NemoClaw setup.