Create Custom Policy Presets

Create a custom preset when a sandbox needs a reviewed endpoint that no maintained NemoClaw preset covers. Custom presets add scoped access to one sandbox without changing the baseline policy.

Author a Preset

Create a preset-format YAML file:

1
preset:
2
  name: my-service-api
3
  description: "Reviewed external service"
4
network_policies:
5
  my-service-api:
6
    name: my-service-api
7
    endpoints:
8
      - host: api.example.com
9
        port: 443
10
        protocol: rest
11
        enforcement: enforce
12
        rules:
13
          - allow: { method: GET, path: "/**" }
14
    binaries:
15
      - { path: /path/to/requesting-binary }

Replace /path/to/requesting-binary with the exact executable path reported for the blocked request in openshell term. For Deep Agents Code, OpenShell commonly reports /usr/local/bin/dcode or /opt/venv/bin/python3*. Authorize only the process that needs the reviewed endpoint.

The top-level preset.name must be a lowercase RFC 1123 label with letters, digits, and hyphens. It must not collide with a maintained preset name such as slack or pypi. Rename preset.name if NemoClaw reports a collision.

Each endpoint must name a specific host or a scoped subdomain wildcard such as *.example.com. NemoClaw rejects catch-all destinations, including *, 0.0.0.0, 0.0.0.0/0, ::, and ::/0. Rule matchers must match the endpoint protocol.

The same protocol-specific matcher shape applies to deny_rules.

User-authored presets must not declare allowed_ips for ordinary endpoints. NemoClaw rejects that field in files passed through --from-file or --from-dir because it can widen the private ranges that OpenShell checks during SSRF protection. Use hostnames, ports, protocols, methods, paths, and binary restrictions instead. The only exception is the host.openshell.internal bridge endpoint for explicit sandbox-to-host service access.

Apply a Single File

Preview the file before you apply it:

$
nemo-deepagents my-assistant policy add --from-file ./presets/my-service-api.yaml --dry-run
$
nemo-deepagents my-assistant policy add --from-file ./presets/my-service-api.yaml --yes

NemoClaw records the complete YAML content with the sandbox. You can remove the preset later without keeping the original file.

Apply Every File in a Directory

Apply preset files in lexicographic order:

$
nemo-deepagents my-assistant policy add --from-dir ./presets/ --yes

Processing stops at the first failure. NemoClaw does not remove presets that it already applied. Fix the failing file and run the command again to continue.

Add a Preset to the Source Catalog

Save a maintained local preset under nemoclaw-blueprint/policies/presets/. The filename without .yaml must match preset.name. The preset catalog reads preset.name, while policy add <name> loads presets/<name>.yaml. A mismatch can list a preset that the named command cannot load.

Apply the catalog preset by name:

$
nemo-deepagents my-assistant policy add my-service-api

Run the same command after editing the file. NemoClaw compares the preset with the live policy and applies changed content.

Remove a Custom Preset

Remove the preset by its recorded name:

$
nemo-deepagents my-assistant policy remove my-service-api --yes

Run nemo-deepagents <name> policy list to see every maintained and custom preset recorded for the sandbox.

Related Topics

• Apply Policy Presets explains preset persistence and reapplication.
• Network Policies describes the policy schema.