> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server. # Network Policies > Baseline network policy, filesystem rules, and operator approval flow. NemoClaw runs with a deny-by-default network policy. The sandbox can only reach endpoints that are explicitly allowed. OpenShell intercepts any request to an unlisted destination and prompts the operator to approve or deny it in real time through the TUI. ## Baseline Policy Hermes sandboxes use an agent-specific baseline policy in `agents/hermes/policy-additions.yaml` so Hermes runtime binaries can reach the service endpoints they need while keeping the same deny-by-default model. ### Filesystem | Path | Access | | ------------------------------------------------------------------------------------ | ---------- | | `/sandbox`, `/tmp`, `/dev/null`, `/dev/pts` | Read-write | | `/usr`, `/lib`, `/proc`, `/dev/urandom`, `/app`, `/etc`, `/var/log`, `/var/lib/dpkg` | Read-only | `/dev/pts` is the pseudo-terminal (devpts) directory. It is writable so PTY-based tools (`tmux`, `script`, and interactive shells) can allocate a terminal. Without it, those tools fail with `fork failed: Permission denied`. Read-only access to `/var/lib/dpkg` lets `dpkg-query` inspect installed package metadata. The filesystem policy does not grant write access to the package database. The sandbox process runs as a dedicated `sandbox` user and group. Landlock LSM enforcement applies on a best-effort basis. ### Network Policies The following endpoint groups are allowed by default: Hermes baseline endpoint groups are declared by the Hermes agent policy additions. Use `nemohermes policy list` or `openshell policy get --base ` on a live sandbox to inspect the exact applied baseline. All endpoints use TLS termination and are enforced at port 443. Messaging endpoints are not part of the common baseline policy. Enable the channel during onboarding or apply the matching preset so the sandbox can reach that platform. ## Policy Tiers During onboarding, the wizard prompts for a policy tier that determines the default set of presets applied on top of the baseline policy. The baseline policy is always applied regardless of the selected tier. An operator can persistently exclude a specific baseline entry with [`policy exclude`](#excluding-a-baseline-entry) when they accept reduced, unsupported functionality. This is the supported registry-backed way to replay a live exact-key removal during rebuild; raw `openshell policy set` edits are not replayed, while edits made to the source baseline itself are applied when the sandbox is recreated. | Tier | Presets included | Description | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Restricted | No tier defaults | Starts from the baseline policy. Web search or messaging integrations selected earlier can still suggest their required presets; deselect them during policy review for baseline-only access. Restricted suppresses other agent-required additions; reapply them later with `policy add` only after reviewing the additional egress. | | Balanced (default) | `npm`, `pypi`, `huggingface`, `brew`, selected `brave` or `tavily` web search preset | Full dev tooling and web search when you select a provider the active agent supports. No messaging platform access. Apply the `weather` preset explicitly if your agent needs read-only weather lookups. | | Open | `npm`, `pypi`, `huggingface`, `brew`, selected `brave` or `tavily` web search preset, `weather`, `public-reference`, `slack`, `discord`, `telegram`, `wechat` (experimental), `whatsapp` (experimental), `jira`, `outlook` | Broad access across third-party services including messaging, productivity, weather, and public-reference APIs. | | Personal | `personal-open-internet` (mandatory) | Lets every sandbox binary open TCP connections to public and private address ranges on destination ports `80` and `443`. The broad route replaces overlapping web endpoints while preserving non-web policy. Unspecified, loopback, and link-local ranges remain blocked. | When Personal is selected or carried forward, the `personal-open-internet` preset is mandatory for every agent and every onboarding entry point. Interactive choices, `NEMOCLAW_POLICY_MODE=custom`, and `NEMOCLAW_POLICY_MODE=skip` control only additional presets; they cannot deselect, skip, or replace Personal's required web authority. #### Personal Tier Network Access The Personal tier applies the `personal-open-internet` policy preset with a hostless L4 endpoint on destination ports `80` and `443`. The policy matches any requested host on either port, then permits the connection only when every resolved address is in the preset's allowed ranges. The rule does not inspect the application protocol or payload, so traffic on these ports is not limited to HTTP or HTTPS. OpenShell does not restrict the hostname, HTTP method, path, or body after the rule permits the connection. An agent can send workspace data or sandbox-visible credentials to an arbitrary reachable service on either port without an operator approval prompt. The preset excludes unspecified, loopback, and link-local address ranges, including the common cloud metadata range. OpenShell also keeps its hard blocks for those destinations. Other destination ports remain denied unless another policy entry permits them. The sandbox's filesystem, process, gateway authentication, and managed credential controls remain active. Use this tier only for trusted personal workloads with trusted prompts and data. Every fresh onboarding run through the experimental Portable profile selects the Personal tier. When `NEMOCLAW_POLICY_PRESETS` is unset, blank, or contains only whitespace, Portable uses `suggested` mode with no optional preset override. If `NEMOCLAW_POLICY_PRESETS` contains a non-blank list, Portable treats that list as authoritative for additional presets while still applying mandatory `personal-open-internet`. `nemohermes onboard --resume` does not override a recorded non-Personal tier; a resumed Personal tier retains or repairs its mandatory preset. After selecting a tier, a combined preset and access-mode screen lets you include or exclude optional presets and toggle each between read (GET only) and read-write (GET + POST/PUT/PATCH) access. On Personal, NemoClaw restores `personal-open-internet` if it is deselected in the screen. Tier-default presets are pre-selected; additional presets can be added from the built-in preset list available to the sandbox's active agent. NemoClaw filters tier defaults and built-in preset choices by the active agent's supported integrations. The `personal-open-internet` preset uses L4 passthrough, so its read-write label does not add HTTP method or path inspection. Hermes can select `tavily` only. NemoClaw automatically suggests the preset that matches the selected provider and removes stale web search presets during resume reconciliation when you switch providers or disable web search. When a later onboarding run does not select a messaging channel and the environment no longer supplies that channel's required values, NemoClaw treats the channel as disabled. NemoClaw then removes that channel's matching policy preset instead of carrying it forward. This removal also runs with `NEMOCLAW_POLICY_MODE=skip` and its `none` or `no` aliases. These modes skip policy preset additions, but they do not preserve a disabled channel's preset. `nemohermes onboard --resume` reconciles the policy selection instead of skipping it when the effective messaging selection omits a channel whose preset remains applied. NemoClaw keeps the preset for an in-sandbox QR-paired channel such as WhatsApp because you pair that channel inside the sandbox rather than through host environment values. The Personal tier does not select a Brave Search or Tavily Search preset by default. Its broad route supports ordinary keyless web fetches, while `web_search` still requires a separately configured provider. Explicit custom preset lists and manual interactive selections remain operator-controlled for additional presets. Hermes managed-tool gateway selections can add Hermes-specific presets, such as Nous-hosted web, image, audio, browser, or code tools, without applying unsupported OpenClaw-only presets. When Hermes uses Tavily, NemoClaw removes `nous-web` from the effective managed-tool selection while preserving other selected Nous tool presets. The applied set therefore reflects the chosen tier *plus* any agent-required presets, so `policy list` may show one or more presets that do not appear in the tier table above. The `policy list` provenance tags are inferred from the current tier YAML and the active agent at display time and are not persisted per preset. A preset whose name matches an entry in the sandbox's current tier definition is labelled `[from tier]` even when an operator added it manually with `policy add` after onboarding; agent-specific preset names are only labelled `[from agent]` when the active agent matches. Claude Code direct egress is not included in the Restricted, Balanced, or Open tiers. Personal's broad route permits its port `443` transport but does not install or configure Claude Code; on other tiers, apply the `claude-code` preset explicitly if you install and run the CLI inside the sandbox with its own credentials. Normal NemoClaw Anthropic inference still routes through the OpenShell gateway. Tier definitions are stored in `nemoclaw-blueprint/policies/tiers.yaml`. In non-interactive mode, set the tier with `NEMOCLAW_POLICY_TIER`: ```bash NEMOCLAW_POLICY_TIER=open nemohermes onboard --non-interactive --yes-i-accept-third-party-software ``` Unset, blank, or whitespace-only `NEMOCLAW_POLICY_TIER` values use the `balanced` default. In non-interactive onboarding, a non-blank value that does not match a known tier exits before preflight, gateway, or inference side effects and lists the valid options. Interactive onboarding ignores an invalid environment value and shows the normal tier prompt. ### Inference The baseline policy allows only the `local` inference route. External inference providers are reached through the OpenShell gateway, not by direct sandbox egress. ## Operator Approval Flow When the agent attempts to reach an endpoint not listed in the policy, OpenShell intercepts the request and presents it in the TUI for operator review. The Personal tier does not prompt for matching TCP connections on destination ports `80` or `443` because `personal-open-internet` already permits them. The flow has these steps: 1. The agent makes a network request to an unlisted host. 2. OpenShell blocks the connection and logs the attempt. 3. The TUI command `openshell term` displays the blocked request with host, port, and requesting binary. 4. The operator approves or denies the request. 5. If approved, the endpoint is added to the running policy for the session. To monitor requests as the agent runs, open the TUI: ```bash openshell term ``` For step-by-step navigation and approval controls, refer to [Approve or Deny Agent Network Requests](../network-policy/approve-network-requests). ## Modifying the Policy ### Static Changes Edit `agents/hermes/policy-additions.yaml` and re-run the onboard wizard: ```bash nemohermes onboard ``` ### Dynamic Changes Apply policy updates to a running sandbox without restarting: ```bash openshell policy update --add-endpoint api.example.com:443:read-only:rest:enforce ``` To replace the live policy with a complete base policy file, export the current base policy and use `openshell policy set`. Requires OpenShell 0.0.72+ for the round-trippable `policy get --base` and `policy set --wait` syntax. ```bash nemohermes policy get > current-policy.yaml ``` NemoClaw strips the OpenShell metadata header and exits non-zero if it cannot validate the base policy. Do not add `--raw` when you plan to edit and reapply the file. Edit or review `current-policy.yaml`, then apply it: ```bash openshell policy set --policy current-policy.yaml --wait ``` ### Excluding a baseline entry The baseline policy applies to every sandbox, but an operator can persistently exclude a specific baseline entry when they accept reduced, unsupported functionality in exchange for tighter egress. Preview the exact scope, then exclude an exact baseline key: ```bash nemohermes policy exclude --dry-run nemohermes policy exclude --force ``` The command prints every endpoint, method/path rule, and binary the exclusion removes. It also names the supported features that may stop working before it requires explicit acknowledgement (`--force` in non-interactive use). NemoClaw refuses to exclude an entry that does not have a reviewed feature-impact disclosure, so a new baseline entry cannot bypass this review. The versioned exclusion record is bound to the reviewed entry content and active agent, recorded in the sandbox registry, and replayed on rebuild. If the sandbox's active agent changes, NemoClaw requires you to clear or review the exclusion again instead of applying an approval from another agent baseline. NemoClaw journals the cross-system update before changing the live OpenShell policy and verifies the exact live result before publishing the durable intent. If the process or persistence layer fails between those steps, `policy list`, `policy explain`, and `status` report `repair required`. Sandbox creation or recreation, rebuild, and cross-sandbox snapshot cloning stop before destructive work, and rerunning the same `policy exclude` or `policy restore` command reconciles only an exact source or target state. An unreadable live policy, or one that matches neither the pre-mutation source nor the intended target, remains fail-closed for manual inspection instead of being guessed or overwritten. An interrupted restore finalizes only when the durable exclusion still exactly matches the staged exclusion and the current release baseline still exactly matches the journaled target; if either changes or becomes unreadable, the journal remains pending for inspection and re-review. If a later release changes that entry, create and rebuild fail closed until re-review; if the release removes it, they fail closed until the stale record is cleared. The critical `managed_inference` entry cannot be excluded because it carries the required route to managed inference. NemoClaw enforces this both when the command runs and whenever durable exclusion state is replayed. An excluded baseline key remains reserved while the exclusion is active. NemoClaw refuses onboarding, rebuild, built-in and custom presets, messaging channel policies, and generated MCP policies that would define the same key and silently restore its egress. It also refuses to exclude a key that an applied preset already owns. Restore the baseline entry before applying a preset that intentionally owns the key, or rename a custom entry whose key represents different access. To recover from baseline drift, first check whether the release changed the entry's content or removed it entirely (`nemohermes policy explain` or `doctor` reports which). If the entry still exists with different content, `policy restore --force` restores the current baseline entry and clears the stale exclusion record. This allows the entry's listed egress before you can exclude it again. Preview the restore and exclusion scopes before applying either change: ```bash nemohermes policy restore --dry-run nemohermes policy restore --force nemohermes policy exclude --dry-run nemohermes policy exclude --force ``` If the release removed the entry entirely, `policy exclude ` fails with `Unknown baseline entry ''.` because there is nothing left to exclude. Preview the stale-record cleanup, then clear the record without changing live egress: ```bash nemohermes policy restore --dry-run nemohermes policy restore --force ``` List active exclusions with `policy list`. `policy explain`, `status`, `doctor`, and snapshot and rebuild summaries also disclose active exclusions and their reduced-support impact. Status and doctor compare each approval with the active agent baseline and verify that the excluded key is absent from the live OpenShell policy. An unreadable live policy is unverified, while a live policy that contains the key is a mismatch that requires repair before you rely on the exclusion. When the current baseline still defines the entry, `policy restore --force` allows the entry's listed egress again and clears its exclusion. When the baseline no longer defines the entry, the command clears only the stale exclusion record. Preview the applicable result before you apply it: ```bash nemohermes policy restore --dry-run nemohermes policy restore --force ``` Both restore paths require acknowledgement unless you use `--dry-run`. A run with a terminal on stdin prompts for confirmation when no acknowledgement flag is present. A run with `NEMOCLAW_NON_INTERACTIVE=1`, or a run without a terminal on stdin, requires `--force`, `--yes`, or `-y`. Excluding a baseline entry leaves agent features that depend on it unsupported for that sandbox.