> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server.

# Explain Network Policy to Agents

> Generate a redacted policy summary that helps an agent classify network failures.

Use `policy-explain` to give a sandbox agent a compact, redacted view of its active network policy.
The summary helps the agent distinguish policy denials, missing credentials, unsupported capabilities, and upstream failures.

## Print the Policy Context

Print the redacted summary:

```bash
nemohermes my-assistant policy-explain
```

Pass `--json` when a tool needs a structured object:

```bash
nemohermes my-assistant policy-explain --json
```

For Hermes, use the printed Markdown or JSON through an operator-controlled prompt or file workflow.
The `--write` target is the OpenClaw workspace and is not a Hermes agent-context integration.

## Understand Redaction

The summary includes the recorded tier, applied presets, allowed host categories, known presets that are not applied, and policy management commands.
It also explains the support boundaries between NemoClaw, OpenShell, and the agent.

The output omits network rule bodies, credential metadata, and binary allowlists.
It includes only host stems and category-level summaries.
NemoClaw drops private, loopback, link-local, metadata, unique-local, reserved, CGNAT, benchmarking, and internal-suffix hosts from `allowedHostCategories`.
It reports their count in `redactedHostCount`.

## Interpret Verification Status

Each active preset includes a `verification` value:

| Status                | Meaning                                                                                                    |
| --------------------- | ---------------------------------------------------------------------------------------------------------- |
| `verified`            | The registry lists the preset, and the gateway confirms enforcement.                                       |
| `registry-only`       | The registry lists the preset, but the gateway does not enforce it. Treat the allowed hosts as unverified. |
| `gateway-only`        | The gateway enforces a preset that the registry does not list.                                             |
| `gateway-unavailable` | NemoClaw could not probe the gateway. Treat the report as advisory until the gateway is reachable.         |

## Classify a Failed Request

The classifier evaluates conditions in this order:

1. `unsupported` means the active agent does not offer the asserted capability.
   Surface the limitation without retrying.
2. `missing-approval` with high confidence means a host on an applied preset returned HTTP 401.
   The network path is open, but credentials are missing or invalid.
3. `missing-approval` with low confidence means a host on an applied preset returned HTTP 403.
   Confirm credentials, then inspect the effective policy for a method, path, protocol, or binary denial.
4. `blocked-by-policy` means no applied preset allows the host or the request returned a network-block error.
   Apply an applicable preset or create a custom preset.
5. `unknown` means no classification matched.
   Surface the underlying error.

Network-block error codes include `EHOSTUNREACH`, `ENETUNREACH`, `ENOTFOUND`, `ECONNREFUSED`, `ETIMEDOUT`, and `EAI_AGAIN`.
A block code on a host from a `registry-only` or `gateway-unavailable` preset produces a low-confidence policy verdict.
A block code on a host from a verified preset stays `unknown` because the gateway already confirmed enforcement.

Each verdict includes `confidence` set to `high` or `low`.
Low confidence means the agent must report multiple possibilities instead of treating one next step as authoritative.

For `blocked-by-policy`, run `nemohermes <name> policy-add <preset>` or follow [Custom Preset Files](customize-network-policy#custom-preset-files).
For `missing-approval`, confirm the API token and scopes.
For `unsupported`, surface the limitation without retrying.

## Related Topics

* [Apply Policy Presets](configure-policies/apply-policy-presets) changes the recorded preset set.
* [Create Custom Policy Presets](configure-policies/create-custom-policy-presets) adds a reviewed custom destination.
* [Network Policies](../reference/network-policies) explains policy enforcement and tiers.