Host exposure
An agent runtime that shares the operator’s host inherits the operator’s reach. Isolation has to be a deployment property, not a habit.
NVIDIA NemoClaw · Sandbox & policy runtime · Switzerland
Enforce the policy outside the agent’s reach.
NemoClaw is NVIDIA’s reference stack for running agent runtimes in environments where security review is part of the process. It builds an isolated container around the agent and routes inference through OpenShell’s managed proxy. Numezis designs, deploys and operates that stack — and keeps its limits explicit.
Primary intentRUNTIME ISOLATION
Control surfaceSANDBOX · NETWORK · INFERENCE
OutcomeINFRASTRUCTURE-LEVEL POLICY
The enterprise question
A prompt is not a control. An operating system boundary is.
Agent frameworks ask the model to behave. NemoClaw removes the question: policy is enforced by the container, the network stack and the inference proxy, outside anything the agent can reach or reason about. That is the difference between a guideline and a control — and it is the distinction a Swiss audit will look for.
Unbounded network
Browsing and tool calls turn an agent into an outbound client. Without an explicit destination policy, exfiltration and SSRF are one instruction away.
Opaque inference
If the model route is implicit, so is the data boundary. Which endpoint served a request, under which contract, has to be an answerable question.
Misplaced confidence
Infrastructure isolation does not review skills, validate tool logic or make an agent’s decisions correct. Treating it as total is the common failure.
Reference pattern
Move the security boundary from the prompt into the runtime.
NemoClaw runs the agent inside NVIDIA OpenShell and configures infrastructure-level controls: sandbox isolation, network policy, filesystem restrictions, SSRF validation and credential handling. We use the pattern as an architecture reference, then adapt isolation, inference and operating model to the real risk profile rather than the default.
Business workflow
Named users, allowed channels, approval gates and accountable outcomes for the work the agent performs.
Agent runtime
The agent loop, skills, tools and session state — OpenClaw, Hermes or another harness, treated as untrusted from below.
NemoClaw · OpenShell
Sandbox isolation, network policy, filesystem restrictions, SSRF validation and credential handling enforced outside the agent.
Inference & infrastructure
Managed proxy routing, explicit model contracts, compute boundary, identity, telemetry and lifecycle ownership.
Control system
Defense in depth, with evidence at every boundary.
Identity & tenancy
Separate hosts, OS identities or gateways wherever trust boundaries differ; no routing identifier is ever treated as authorization.
Network policy
Default-restricted egress, explicit destinations, DNS and SSRF controls, and exceptions that are reviewed rather than accumulated.
Filesystem isolation
Minimum readable and writable paths, read-only runtime surfaces, and protected configuration and credential stores.
Credentials
Dedicated identities, scoped and rotated secrets, mediated access, and no primary-account credentials inside the agent state.
Tools & approvals
Allowlisted capabilities, human confirmation for consequential actions, and a clean separation between reasoning and execution.
Evidence & response
Action logs, configuration baselines, policy tests, anomaly review, patch ownership and a defined shutdown path.
Numezis delivery
From experiment to a controlled agent service.
01
Threat model
Map users, channels, tools, data, credentials and credible abuse paths before anything is deployed.
TRUST BOUNDARY MAP02
Isolate
Choose the host and sandbox model, define network and filesystem policy, and separate tenants.
RUNTIME BASELINE03
Integrate
Connect only approved systems, with scoped identities, mediated secrets and explicit action contracts.
INTEGRATION RECORD04
Verify
Test prompt injection, policy bypass, credential access, dangerous tools and recovery behaviour.
SECURITY EVIDENCE05
Operate
Instrument activity, cost and quality; own upgrades, incidents, exceptions and periodic access reviews.
OPERATING CONTROLFAQ
NemoClaw in the enterprise: the questions that matter.
Is NemoClaw just OpenClaw with a new name?
No. NemoClaw is a broader stack that can host OpenClaw or a Hermes-style agent. Its contribution is the layer underneath: OS-level sandboxing, policy enforcement outside the agent’s reach, and inference routed through a managed proxy.
Do we need NVIDIA GPUs to use it?
The isolation and policy layer is the reason most organisations adopt the pattern, and the architecture question is where inference is served from. We size compute against the workload and the data boundary rather than assuming a hardware answer.
What does NemoClaw not protect against?
It does not review the agent’s skills, validate tool logic, or judge whether an action was appropriate. Prompt injection can still cause a permitted action to be taken for a bad reason. Application-layer controls and human approval gates stay necessary.
How does this fit an existing Kubernetes or GPU platform?
As a workload with an explicit trust boundary. We map it to your identity, network policy, secret management and observability rather than standing up a parallel platform that nobody owns.
Important boundary
NemoClaw strengthens infrastructure controls. It does not replace application security.
NVIDIA’s own documentation is explicit: NemoClaw adds infrastructure-level protection while application-layer controls remain the responsibility of the agent runtime and the deployment team. We preserve that boundary in the architecture and in the assurance evidence, because a control that is assumed to cover more than it does is worse than no control at all.
NemoClaw is third-party technology published by NVIDIA. Numezis provides independent architecture, engineering and security expertise around it; no partnership, certification or endorsement is implied without a formal announcement.