Runtime Controls and Sandbox Mutability

This page is the single reference for two related operator questions about a running NemoClaw sandbox:

1. Which parts of my sandbox can I change while it is running, and which require a rebuild or re-onboard?
2. How do I temporarily lower or restore the sandbox security posture for an operator session?

The mutability table below answers question 1. The shields commands answer question 2.

What you can change at runtime

NemoClaw applies its security posture in three layers — what is baked into the sandbox image at onboard, what is hot-reloadable on the running sandbox, and what requires a rebuild or re-onboard. The table below maps each commonly changed item to the layer that owns it and the command that changes it.

If a row above conflicts with what you observe, the runtime source of truth inside the sandbox is /opt/nemoclaw/openclaw.json; the host registry caches metadata but the image and OpenClaw read from the in-sandbox file.

Shields commands

Shields are an operator-only switch that toggles the sandbox between its default mutable state and a locked-down posture. The sandbox itself cannot raise or lower its own shields — every transition is initiated from the host so a compromised agent cannot escape its policy by editing config.

Three commands manage the posture. The commands are hidden from the standard --help output because they are operator workflows, not developer workflows; everything below documents the full surface.

shields status

Print the current shields mode (mutable_default, locked, or temporarily_unlocked), the active policy preset, and any pending automatic restore timer.

1
$ nemoclaw my-assistant shields status
2
Shields:   locked
3
Policy:    strict
4
Auto-restore: not scheduled (use `shields down --timeout 10m` to schedule)

shields up

Raise shields: lock openclaw.json (and other mutable config files) against in-sandbox edits and apply the restrictive network policy that was captured the last time the sandbox was shielded. This is the default expected state for a sandbox the operator has handed off to an agent.

1
$ nemoclaw my-assistant shields up
2
✓ Shields raised: config locked, restrictive policy applied

shields up takes no flags. If no saved snapshot exists yet (a fresh sandbox), the snapshot is taken from the current state.

shields down

Lower shields: unlock config and apply a permissive (or operator-named) network policy so the operator can edit openclaw.json, swap presets, or run interactive maintenance.

1
$ nemoclaw my-assistant shields down --timeout 10m --reason "rotating slack token"
2
✓ Shields lowered for 10m (policy: permissive); auto-restore at 14:32 UTC

The auto-restore timer is detached from the shields down invocation — closing your terminal does not cancel the restore. If the timer process is killed before the deadline (e.g. host reboot), shields status will surface the inconsistency on the next check (see #3112 for the fail-open fix).

See also

The mutability table above is a consolidated index of information that lives in more detail on per-topic pages:

• Manage Sandbox Lifecycle — full rebuild / re-onboard / upgrade workflow.
• Switch Inference Providers — the rebuild path for provider and model changes.
• Customize Network Policy and Approve Network Requests — runtime policy editing and operator approval flow.
• Security Best Practices — the per-attack-surface posture table that this page complements.
• OpenClaw Security Controls — application-layer controls that operate independently of NemoClaw.
• CLI Commands Reference — full flag surface for every nemoclaw command, including the env vars that affect runtime behavior.