nemoclaw-user-manage-policy

Sandbox egress network policy is configured by adding, removing, or modifying allowed endpoints within the NemoClaw policy. You can apply static YAML edits during onboarding or dynamically adjust running policies without restarting sandboxes.

OpenShell supports interactive approval workflows for sandbox network requests, allowing you to inspect, verify, and audit policy changes. This ensures repeatable and trackable configurations across development, test, and production environments.

To enforce least-privilege egress rules, use NemoClaw policy presets to apply a minimal baseline, then add only the specific required network endpoints to the sandbox policy. You can verify these configurations using OpenShell tooling.

You can dynamically update running sandbox network policies without restarting by modifying allowed endpoints at runtime. NemoClaw supports runtime policy adjustments alongside static YAML edits for OpenShell-enabled sandboxes.

You can audit and verify sandbox endpoint access changes using OpenShell and NemoClaw tooling. This allows you to inspect policy modifications, ensuring that egress rules remain repeatable and trackable across environments.

Policy presets are available for post-install sandbox network setup, allowing you to quickly choose a baseline configuration during NemoClaw onboarding. You can then apply minimal egress rules to allow required endpoints.