> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server.

# Apply Policy Presets

> Add, reapply, list, or remove policy presets for a running NemoClaw sandbox.

Use policy presets to add reviewed network access to one running sandbox without replacing its current policy.
NemoClaw records applied presets so rebuild and restore operations can replay them.

Use `nemohermes <name> policy-add` to merge a preset into the running policy.
The OpenShell `policy set` command replaces the live policy instead of merging it.
Follow [Replace the Live Network Policy](replace-live-network-policy) only when you need full-policy replacement.

## Choose a Maintained Preset

During onboarding, the selected [policy tier](../../reference/network-policies#policy-tiers) determines which maintained presets are enabled by default.
The interactive preset screen lets you add or remove individual presets.
Messaging channel choices are scoped to the active agent, so unsupported channel presets do not appear.

List the presets available to the sandbox:

```bash
nemohermes <name> policy-list
```

For the maintained preset catalog and guided service workflows, refer to [Common Integration Policy Examples](../integration-policy-examples).

## Preview and Apply a Preset

Use `--dry-run` to review the endpoints, rules, and binaries before applying the preset:

```bash
nemohermes my-assistant policy-add pypi --dry-run
nemohermes my-assistant policy-add pypi --yes
```

Omit the preset name to use the interactive picker:

```bash
nemohermes my-assistant policy-add
```

Pass a preset name with `--yes` for scripted workflows.
Set `NEMOCLAW_NON_INTERACTIVE=1` instead of `--yes` to use the same non-interactive flow through an environment variable.

## Reapply an Edited Preset

Run the same `policy-add` command after you edit a maintained or recorded custom preset.
NemoClaw compares the preset with the live policy.
If the content differs, it applies the changed content.
You do not need to remove the preset first.

The merge starts from the round-trippable base policy returned by `openshell policy get --base`.
It excludes provider-composed `_provider_*` entries because OpenShell reserves that namespace and rejects it in `policy set`.
Existing presets and baseline entries remain in place.

## List and Remove Presets

List every preset recorded for the sandbox:

```bash
nemohermes <name> policy-list
```

Remove a preset when the sandbox no longer needs its access:

```bash
nemohermes my-assistant policy-remove pypi --yes
```

`policy-remove` accepts maintained and custom preset names.

## Understand Persistence

Dynamic changes apply to the current live policy.
NemoClaw also records maintained presets and custom presets applied through `--from-file` or `--from-dir`.
The custom preset record includes the full YAML content.
Snapshot restore and rebuild replay the recorded presets, even when the original custom file no longer exists.

`nemohermes <name> rebuild` reapplies every recorded policy preset to the recreated sandbox.
For baseline changes that apply to every future sandbox, follow [Change the Baseline Network Policy](change-baseline-network-policy).

## Approve One Request

For one-off access, approve a blocked request in the OpenShell TUI:

```bash
openshell term
```

Use the TUI to test a destination before deciding whether it belongs in a maintained or custom preset.
For the complete approval workflow, refer to [Approve or Deny Network Requests](../approve-network-requests).

## Related Topics

* [Create Custom Policy Presets](create-custom-policy-presets) adds an endpoint that no maintained preset covers.
* [Explain Network Policy to Agents](../explain-network-policy-to-agents) summarizes active and missing presets.
* [Commands](../../reference/commands#nemohermes-name-policy-add) lists every policy command flag.