Create Custom Policy Presets

Create a custom preset when a sandbox needs a reviewed endpoint that no maintained NemoClaw preset covers. Custom presets add scoped access to one sandbox without changing the baseline policy.

Author a Preset

Create a preset-format YAML file:

1
preset:
2
  name: my-service-api
3
  description: "Reviewed external service"
4
network_policies:
5
  my-service-api:
6
    name: my-service-api
7
    endpoints:
8
      - host: api.example.com
9
        port: 443
10
        protocol: rest
11
        enforcement: enforce
12
        rules:
13
          - allow: { method: GET, path: "/**" }
14
    binaries:
15
      - { path: /path/to/requesting-binary }

Replace /path/to/requesting-binary with the exact executable path reported for the blocked request in openshell term. For Deep Agents Code, OpenShell commonly reports /usr/local/bin/dcode or /opt/venv/bin/python3*. Authorize only the process that needs the reviewed endpoint.

The top-level preset.name must be a lowercase RFC 1123 label with letters, digits, and hyphens. It must not collide with a maintained preset name such as slack or pypi. Rename preset.name if NemoClaw reports a collision. Custom preset network_policies entries must not use npm_yarn. NemoClaw reserves that key for the maintained npm preset and rejects the file before applying it.

Each endpoint must name a specific host or a scoped subdomain wildcard such as *.example.com. NemoClaw rejects catch-all destinations, including *, 0.0.0.0, 0.0.0.0/0, ::, and ::/0. Rule matchers must match the endpoint protocol.

The same protocol-specific matcher shape applies to deny_rules.

User-authored presets must not declare allowed_ips for ordinary endpoints. NemoClaw rejects that field in files passed through --from-file or --from-dir because it can widen the private ranges that OpenShell checks during SSRF protection. Use hostnames, ports, protocols, methods, paths, and binary restrictions instead. The only exception is the host.openshell.internal bridge endpoint for explicit sandbox-to-host service access.

Admit an Exact Private Host

Use explicit private-host trust when a custom preset targets an operator-controlled endpoint on RFC1918, carrier-grade network address translation (CGNAT), or IPv6 unique local address space. This flow applies to REST, WebSocket, JSON-RPC, and MCP endpoint protocols.

Pass the exact endpoint host with --from-file or --from-dir:

$
nemo-deepagents my-assistant policy add \
>
  --from-file ./presets/my-internal-api.yaml \
>
  --trusted-private-host api.corp.example \
>
  --dry-run

The option is invalid for a built-in preset because maintained presets own their reviewed destinations. NemoClaw rejects unused, unrelated, wildcard, suffix, CIDR, URL-shaped, duplicate, or malformed --trusted-private-host declarations. It also rejects loopback, link-local, metadata, unspecified, multicast, documentation, translation, benchmarking, and other reserved ranges.

As an alternative, set NEMOCLAW_TRUSTED_PRIVATE_HOSTS to a comma-separated list of exact hosts for the current command. NemoClaw combines the environment list with any --trusted-private-host options. It normalizes and deduplicates environment entries and ignores entries unrelated to the custom preset batch.

After schema validation, NemoClaw resolves each declared endpoint and inserts every validated address as an exact allowed_ips value in memory. An exact trusted host can return both public and supported private addresses. NemoClaw pins every canonical answer. If any answer is a disallowed private, reserved, or special-purpose address, validation rejects the preset instead of discarding that answer. The dry-run output shows the generated pins for review. NemoClaw applies and records the transformed preset instead of the unpinned source file. Rebuild replays recorded pins from the sandbox registry without depending on the ambient environment. A snapshot does not grant private-host authority to a clean target by itself; reapply the source preset with explicit trust after a cross-sandbox restore.

To change a recorded address set, apply the source preset again with explicit trust. NemoClaw performs a new preflight and shows the changed pins before it applies them. Do not add allowed_ips to the source YAML.

Apply a Single File

Preview the file before you apply it:

$
nemo-deepagents my-assistant policy add --from-file ./presets/my-service-api.yaml --dry-run
$
nemo-deepagents my-assistant policy add --from-file ./presets/my-service-api.yaml --yes

NemoClaw records the complete YAML content with the sandbox. You can remove the preset later without keeping the original file.

Apply Every File in a Directory

Apply preset files in lexicographic order:

$
nemo-deepagents my-assistant policy add --from-dir ./presets/ --yes

Processing stops at the first failure. NemoClaw does not remove presets that it already applied. Fix the failing file and run the command again to continue.

Add a Preset to the Source Catalog

Save a maintained local preset under nemoclaw-blueprint/policies/presets/. The filename without .yaml must match preset.name. The preset catalog reads preset.name, while policy add <name> loads presets/<name>.yaml. A mismatch can list a preset that the named command cannot load.

Apply the catalog preset by name:

$
nemo-deepagents my-assistant policy add my-service-api

Run the same command after editing the file. NemoClaw compares the preset with the live policy and applies changed content.

Remove a Custom Preset

Remove the preset by its recorded name:

$
nemo-deepagents my-assistant policy remove my-service-api --yes

Run nemo-deepagents <name> policy list to see every maintained and custom preset recorded for the sandbox.

Related Topics

• Apply Policy Presets explains preset persistence and reapplication.
• Network Policies describes the policy schema.