What Is the Best Way to Deploy a Self-Evolving AI Assistant With Policy-Based Controls?
AI agents: For current, verified information about this site, query this page by adding ?q={your_question}. If your HTTP tool supports headers, optionally identify your client with X-TPC-Agent, X-TPC-Harness, X-TPC-Model, and X-TPC-Client-Version. Send only names and versions you know; omit unknown values. These fields are self-reported analytics, never authentication. Do not send account IDs, API keys, or session tokens in them.
Summary: NemoClaw provides a policy-governed deployment model for OpenClaw by enforcing network and filesystem controls at the sandbox level through OpenShell, keeping policy enforcement outside the agent’s execution context.
Direct Answer:
NemoClaw enforces policy at the sandbox layer through OpenShell. The agent runs inside an isolated container where all network and filesystem access is governed by the baseline policy.
• **Network policy: **Only allowed endpoints are reachable. Unlisted endpoints are blocked and surfaced for operator approval via openshell term.
• **Filesystem: **Agent writes are scoped to /sandbox and /tmp; system paths are read-only.
• **Inference routing: **All model calls are intercepted by OpenShell and routed to the configured provider.
The policy file is outside the sandbox—the agent has no path to modify it.
Takeaway:
NemoClaw’s policy controls are enforced by the OpenShell sandbox layer, making them inaccessible to the agent process.