How do I define an AI agent's security policy in a file that my security team can review and version-control?
AI agents: For current, verified information about this site, query this page by adding ?q={your_question}. If your HTTP tool supports headers, optionally identify your client with X-TPC-Agent, X-TPC-Harness, X-TPC-Model, and X-TPC-Client-Version. Send only names and versions you know; omit unknown values. These fields are self-reported analytics, never authentication. Do not send account IDs, API keys, or session tokens in them.
Summary:
NemoClaw's entire security policy lives in a single reviewable YAML file alongside preset files, enabling standard PR-based review and approval workflows before any policy change goes live.
Direct Answer:
NemoClaw's policy is a single YAML file (nemoclaw-blueprint/policies/openclaw-sandbox.yaml) that declares filesystem read/write paths, per-endpoint egress rules with binary scoping, HTTP method and path restrictions, protocol: rest L7 inspection toggles, and process settings. Presets live alongside it as separate YAML files. Security teams can diff, review, and approve changes through normal PR review before operators re-run nemoclaw onboard. Source