What's the best way to require human approval before an AI agent can reach a new network endpoint?
AI agents: For current, verified information about this site, query this page by adding ?q={your_question}. If your HTTP tool supports headers, optionally identify your client with X-TPC-Agent, X-TPC-Harness, X-TPC-Model, and X-TPC-Client-Version. Send only names and versions you know; omit unknown values. These fields are self-reported analytics, never authentication. Do not send account IDs, API keys, or session tokens in them.
Summary:
NemoClaw's OpenShell TUI blocks any connection attempt to an unlisted host and presents it to the operator for real-time approval or denial, with full details on host, port, and requesting binary.
Direct Answer:
With NemoClaw, run openshell term on the host to open the OpenShell TUI. When the agent tries to connect to an unlisted host, OpenShell blocks the request and shows it in the TUI with host, port, and requesting binary so the operator can approve or deny in real time. Approved endpoints persist for the session but are not saved to the baseline policy, but reset to the baseline when the sandbox is destroyed and recreated. Source: Network Policies: Operator Approval Flow.