> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server.

# Approve or Deny Agent Network Requests

> Review and approve blocked agent network requests in the TUI.

Review network requests that the agent makes to endpoints that are not listed in the sandbox policy.
OpenShell intercepts those requests and presents them in the TUI for operator approval.

## Prerequisites

* A running NemoClaw sandbox.
* The OpenShell CLI on your `PATH`.
* Access to the host where the sandbox is running.

## Open the TUI

Start the OpenShell terminal UI to monitor sandbox activity:

#### Local Sandbox

```bash
openshell term
```

#### Remote Sandbox

Connect to the remote host first.
Replace `<your-sandbox-host>` with the SSH host or alias where your NemoClaw sandbox is running.
Use a host that resolves from your terminal, such as an SSH alias from your client configuration.

```bash
ssh <your-sandbox-host>
```

Then start the TUI on that host.

```bash
openshell term
```

The TUI shows the sandbox state, active inference provider, and live network activity.
From the dashboard, select the running sandbox with `j` or `k`, then press `Enter` to open the sandbox view.

## Trigger a Blocked Request

When the agent tries to reach an endpoint that is not in the baseline policy, OpenShell blocks the connection and displays the request in the TUI.
The blocked request includes the following details:

* **Host and port** for the destination.
* **Binary** that initiated the request.
* **HTTP method** and path, if available.

## Approve or Deny the Request

Blocked requests appear as pending entries in the sandbox view's `Network Rules` panel.
After the sandbox opens, the TUI focuses the sandbox policy view.
Press `r` to focus `Network Rules`.
Use `j` or `k` to select a pending rule, and press `Enter` to inspect its details.

* Press `a` to approve the selected pending rule and add the endpoint to the running policy for the current session.
* Press `x` to reject the selected pending rule and keep the endpoint blocked.
* Press `A` to approve all pending rules, then press `y` or `Enter` at the confirmation prompt.

Approved endpoints remain in the running policy for the sandbox instance.
They reset to the baseline when you destroy and recreate the sandbox.
They are not persisted to the baseline policy file.
To keep an endpoint allowed for future sandbox instances, update the policy YAML or apply a preset as described in [Customize the Sandbox Network Policy](customize-network-policy).
Rejected rules stay blocked unless you later approve the same rule or add a matching endpoint to the policy.

## Related Topics

* [Customize the Sandbox Network Policy](customize-network-policy) to add endpoints permanently.
* [Network Policies](../reference/network-policies) for the full baseline policy reference.