Network Policies
NemoClaw runs with a deny-by-default network policy. The sandbox can only reach endpoints that are explicitly allowed. OpenShell intercepts any request to an unlisted destination and prompts the operator to approve or deny it in real time through the TUI.
Baseline Policy
Hermes sandboxes use an agent-specific baseline policy in agents/hermes/policy-additions.yaml so Hermes runtime binaries can reach the service endpoints they need while keeping the same deny-by-default model.
Filesystem
/dev/pts is the pseudo-terminal (devpts) directory. It is writable so PTY-based tools (tmux, script, and interactive shells) can allocate a terminal. Without it, those tools fail with fork failed: Permission denied.
Read-only access to /var/lib/dpkg lets dpkg-query inspect installed package metadata. The filesystem policy does not grant write access to the package database.
The sandbox process runs as a dedicated sandbox user and group.
Landlock LSM enforcement applies on a best-effort basis.
Network Policies
The following endpoint groups are allowed by default:
Hermes baseline endpoint groups are declared by the Hermes agent policy additions. Use nemohermes <sandbox> policy list or openshell policy get --base <sandbox> on a live sandbox to inspect the exact applied baseline.
All endpoints use TLS termination and are enforced at port 443.
Messaging endpoints are not part of the common baseline policy. Enable the channel during onboarding or apply the matching preset so the sandbox can reach that platform.
Policy Tiers
During onboarding, the wizard prompts for a policy tier that determines the default set of presets applied on top of the baseline policy. The baseline policy is always applied regardless of the selected tier. An operator can exclude a specific baseline entry from the current OpenShell policy with policy exclude when they accept reduced, unsupported functionality. NemoClaw stores no separate exclusion record. Rebuild and clone carry the current OpenShell policy forward, so changes made through NemoClaw, the OpenShell TUI, or direct host-side policy editing have the same lifecycle.
When Personal is selected or carried forward, the personal-open-internet preset is mandatory for every agent and every onboarding entry point. Interactive choices, NEMOCLAW_POLICY_MODE=custom, and NEMOCLAW_POLICY_MODE=skip control only additional presets; they cannot deselect, skip, or replace Personal’s required web authority.
Personal Tier Network Access
The Personal tier applies the personal-open-internet policy preset with a hostless L4 endpoint on destination ports 80 and 443.
The policy matches any requested host on either port, then permits the connection only when every resolved address is in the preset’s allowed ranges.
The rule does not inspect the application protocol or payload, so traffic on these ports is not limited to HTTP or HTTPS.
OpenShell does not restrict the hostname, HTTP method, path, or body after the rule permits the connection.
An agent can send workspace data or sandbox-visible credentials to an arbitrary reachable service on either port without an operator approval prompt.
The preset excludes unspecified, loopback, and link-local address ranges, including the common cloud metadata range. OpenShell also keeps its hard blocks for those destinations. Other destination ports remain denied unless another policy entry permits them. The sandbox’s filesystem, process, gateway authentication, and managed credential controls remain active. Use this tier only for trusted personal workloads with trusted prompts and data.
Every fresh onboarding run through the experimental Portable profile selects the Personal tier. When NEMOCLAW_POLICY_PRESETS is unset, blank, or contains only whitespace, Portable uses suggested mode with no optional preset override. If NEMOCLAW_POLICY_PRESETS contains a non-blank list, Portable treats that list as authoritative for additional presets while still applying mandatory personal-open-internet during that onboarding transaction. Resume and reuse derive effective access from the current OpenShell policy rather than a recorded tier.
After selecting a tier, a combined preset and access-mode screen lets you include or exclude optional presets and toggle each between read (GET only) and read-write (GET + POST/PUT/PATCH) access. On Personal, NemoClaw restores personal-open-internet if it is deselected in the screen. Tier-default presets are pre-selected; additional presets can be added from the built-in preset list available to the sandbox’s active agent. NemoClaw filters tier defaults and built-in preset choices by the active agent’s supported integrations. The personal-open-internet preset uses L4 passthrough, so its read-write label does not add HTTP method or path inspection.
Hermes can select tavily only.
NemoClaw automatically suggests the preset that matches the selected provider and removes stale web search presets during resume reconciliation when you switch providers or disable web search.
When a later onboarding run does not select a messaging channel and the environment no longer supplies that channel’s required values, NemoClaw treats the channel as disabled.
NemoClaw then removes that channel’s matching policy preset instead of carrying it forward.
This removal also runs with NEMOCLAW_POLICY_MODE=skip and its none or no aliases.
These modes skip optional policy preset additions, but they still apply the required preset for an enabled channel and do not preserve a disabled channel’s preset.
nemohermes onboard --resume reconciles the policy selection instead of skipping it when the effective messaging selection omits a channel whose preset remains applied.
NemoClaw keeps the preset for an in-sandbox QR-paired channel such as WhatsApp because you pair that channel inside the sandbox rather than through host environment values.
The Personal tier does not select a Brave Search or Tavily Search preset by default.
Its broad route supports ordinary keyless web fetches, while web_search still requires a separately configured provider.
Explicit custom preset lists and manual interactive selections remain operator-controlled for additional presets.
Hermes managed-tool gateway selections can add Hermes-specific presets, such as Nous-hosted web, image, audio, browser, or code tools, without applying unsupported OpenClaw-only presets.
When Hermes uses Tavily, NemoClaw removes nous-web from the effective managed-tool selection while preserving other selected Nous tool presets.
The applied set therefore reflects the chosen tier plus any agent-required presets, so policy list may show one or more presets that do not appear in the tier table above.
The policy list provenance tags are inferred from the current tier YAML and the active agent at display time and are not persisted per preset.
A preset whose name matches an entry in the sandbox’s current tier definition is labelled [from <tier> tier] even when an operator added it manually with policy add after onboarding; agent-specific preset names are only labelled [from <agent> agent] when the active agent matches.
Claude Code direct egress is not included in the Restricted, Balanced, or Open tiers.
Personal’s broad route permits its port 443 transport but does not install or configure Claude Code; on other tiers, apply the claude-code preset explicitly if you install and run the CLI inside the sandbox with its own credentials.
Normal NemoClaw Anthropic inference still routes through the OpenShell gateway.
Tier definitions are stored in nemoclaw-blueprint/policies/tiers.yaml.
In non-interactive mode, set the tier with NEMOCLAW_POLICY_TIER:
Unset, blank, or whitespace-only NEMOCLAW_POLICY_TIER values use the balanced default. In non-interactive onboarding, a non-blank value that does not match a known tier exits before preflight, gateway, or inference side effects and lists the valid options. Interactive onboarding ignores an invalid environment value and shows the normal tier prompt.
Inference
The baseline policy allows only the local inference route. External inference providers are reached through the OpenShell gateway, not by direct sandbox egress.
Operator Approval Flow
When the agent attempts to reach an endpoint not listed in the policy, OpenShell intercepts the request and presents it in the TUI for operator review. The Personal tier does not prompt for matching TCP connections on destination ports 80 or 443 because personal-open-internet already permits them. The flow has these steps:
- The agent makes a network request to an unlisted host.
- OpenShell blocks the connection and logs the attempt.
- The TUI command
openshell termdisplays the blocked request with host, port, and requesting binary. - The operator approves or denies the request.
- If approved, the endpoint is added to the running policy for the session.
To monitor requests as the agent runs, open the TUI:
For step-by-step navigation and approval controls, refer to Approve or Deny Agent Network Requests.
Modifying the Policy
Static Changes
Edit agents/hermes/policy-additions.yaml and re-run the onboard wizard:
Dynamic Changes
Apply policy updates to a running sandbox without restarting:
To replace the live policy with a complete base policy file, export the current base policy and use openshell policy set. Requires OpenShell 0.0.72+ for the round-trippable policy get --base and policy set --wait syntax.
NemoClaw strips the OpenShell metadata header and exits non-zero if it cannot validate the base policy. Do not add --raw when you plan to edit and reapply the file.
Edit or review current-policy.yaml, then apply it:
Excluding a baseline entry
The baseline applies to every sandbox, but an operator can remove one exact baseline entry from the current OpenShell policy after accepting the reduced-support impact.
Preview and apply the live change:
The command prints the endpoints, method and path rules, binaries, and supported features affected by the removal. It refuses entries without a reviewed feature-impact disclosure and refuses keys required by an active preset. The critical managed_inference entry cannot be excluded because it carries the required managed-inference route.
NemoClaw reads the current OpenShell policy, removes the selected key, writes the complete modified document, and verifies the live result. It does not create an exclusion record, journal, or replay state. Rebuild and clone preserve the current OpenShell policy as a whole, so a change made with this command has the same lifecycle as one made through the OpenShell TUI or another trusted host process.
Restore an entry from the current agent baseline with:
If the current baseline still defines the key, restore previews and then adds that current entry to the live OpenShell policy. If the baseline no longer defines it, the command reports that there is nothing to restore and leaves the live policy unchanged. Both mutation commands require acknowledgement unless --dry-run is used. A non-interactive run requires --force, --yes, or -y.
Excluding a baseline entry leaves agent features that depend on it unsupported for that sandbox.