nemoclaw-user-manage-policy

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Customize the Sandbox Network Policy

自定义沙箱网络策略

Gotchas

注意事项

Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.

自定义预设主机可绕过NemoClaw的审核流程，可能将沙箱出站范围扩大到任意目标地址。

Prerequisites

前提条件

A running NemoClaw sandbox for dynamic changes, or the NemoClaw source repository for static changes.
The OpenShell CLI on your
```
PATH
```
.

Add, remove, or modify the endpoints that the sandbox is allowed to reach.

The sandbox policy is defined in a declarative YAML file in the NemoClaw repository and enforced at runtime by NVIDIA OpenShell. NemoClaw supports both static policy changes that persist across restarts and dynamic updates applied to a running sandbox through the OpenShell CLI.

Note:

If the sandbox needs to reach an HTTP service running on the host, expose the service on a host IP that the OpenShell gateway can reach. Apply a custom NemoClaw preset with

nemoclaw <sandbox> policy-add --from-file

. Do not rely on

host.docker.internal

as a general host-service path because it bypasses the OpenShell policy path and may not be reachable in every sandbox runtime. See Agent cannot reach a host-side HTTP service (use the

nemoclaw-user-reference

skill).

运行中的NemoClaw沙箱（用于动态修改），或NemoClaw源码仓库（用于静态修改）。
系统
```
PATH
```
中已配置OpenShell CLI。

添加、移除或修改沙箱允许访问的端点。

沙箱策略在NemoClaw仓库的声明式YAML文件中定义，并由NVIDIA OpenShell在运行时强制执行。 NemoClaw支持两种策略修改方式：静态修改（修改后需重启沙箱生效，且更改会持久化），以及通过OpenShell CLI对运行中的沙箱进行动态更新。

注意：

如果沙箱需要访问主机上运行的HTTP服务，请将服务暴露在OpenShell网关可访问的主机IP上。使用

nemoclaw <sandbox> policy-add --from-file

应用自定义NemoClaw预设。不要依赖

host.docker.internal

作为通用主机服务路径，因为它会绕过OpenShell策略路径，且在部分沙箱运行环境中可能无法访问。如需了解更多，请使用

nemoclaw-user-reference

技能查看「Agent无法访问主机端HTTP服务」相关内容。

Static Changes

静态修改

Static changes modify the baseline policy file and take effect after the next sandbox creation.

静态修改会更改基线策略文件，需在下次创建沙箱时生效。

Edit the Policy File

编辑策略文件

Open

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

and add or modify endpoint entries.

If you want a built-in preset to be part of the baseline policy, merge its

network_policies

entries into this file and re-run

nemoclaw onboard

If you only need to apply a preset to a running sandbox, use

nemoclaw <name> policy-add

under Dynamic Changes. That updates the live policy and does not edit

openclaw-sandbox.yaml

Use a manual YAML edit when you need to allow custom hosts that are not covered by a preset, such as an internal API or a weather service.

Each entry in the

network

section defines an endpoint group with the following fields:

endpoints

: Host and port pairs that the sandbox can reach.

binaries

: Executables allowed to use this endpoint.

rules

: HTTP methods and paths that are permitted.

打开

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

，添加或修改端点条目。

如果希望将内置预设纳入基线策略，请将其

network_policies

条目合并到该文件中，然后重新运行

nemoclaw onboard

。

如果仅需对运行中的沙箱应用预设，请使用动态修改中的

nemoclaw <name> policy-add

命令。该命令会更新实时策略，且不会编辑

openclaw-sandbox.yaml

文件。

当需要允许预设未覆盖的自定义主机（如内部API或天气服务）时，可手动编辑YAML文件。

network

部分的每个条目定义一个端点组，包含以下字段：

endpoints

: 沙箱可访问的主机与端口对。

binaries

: 被允许使用该端点的可执行文件。

rules

: 允许的HTTP方法和路径。

Re-Run Onboard

重新运行Onboard向导

Apply the updated policy by re-running the onboard wizard:

console

$ nemoclaw onboard

The wizard picks up the modified policy file and applies it to the sandbox.

通过重新运行Onboard向导应用更新后的策略：

console

$ nemoclaw onboard

向导会识别修改后的策略文件并将其应用到沙箱。

Verify the Policy

验证策略

Check that the sandbox is running with the updated policy:

console

$ nemoclaw <name> status

检查沙箱是否已运行更新后的策略：

console

$ nemoclaw <name> status

Add Blueprint Policy Additions

添加蓝图策略扩展

If you maintain a custom blueprint, you can add extra policy entries under

components.policy.additions

nemoclaw-blueprint/blueprint.yaml

. NemoClaw validates those entries with the same policy schema used by preset files, fetches the live policy during sandbox creation, merges the additions into

network_policies

, and applies the merged policy through OpenShell. The applied additions are recorded in the run metadata so you can audit which blueprint-level policy entries were active for that sandbox run.

如果维护自定义蓝图，可在

nemoclaw-blueprint/blueprint.yaml

的

components.policy.additions

下添加额外策略条目。 NemoClaw会使用预设文件相同的策略架构验证这些条目，在沙箱创建期间获取实时策略，将扩展条目合并到

network_policies

中，并通过OpenShell应用合并后的策略。已应用的扩展会记录在运行元数据中，以便审计该沙箱运行期间生效的蓝图级策略条目。

Dynamic Changes

动态修改

Dynamic changes apply a policy update to a running sandbox without restarting it.

[!WARNING]
openshell policy set
replaces the sandbox's live policy with the contents of the file you provide; it does not merge. A running sandbox's live policy is the baseline from
openclaw-sandbox.yaml
plus every preset that was layered on during onboarding. Applying a file that contains only the baseline (or only a single preset) silently drops every other preset that was in effect.

动态修改可在不重启沙箱的情况下，对运行中的沙箱应用策略更新。

[!WARNING]
openshell policy set
命令会替换沙箱的实时策略为你提供的文件内容，而非合并。运行中沙箱的实时策略由
openclaw-sandbox.yaml
的基线策略加上Onboarding期间叠加的所有预设组成。仅包含基线（或单个预设）的文件会静默丢弃所有已生效的其他预设。

Option 1: Drop a Preset File and Use

policy-add

(Recommended)

选项1：添加预设文件并使用

policy-add

（推荐）

This is the non-destructive path and the only flow NemoClaw supports out of the box for merging new entries into a running policy.

Create a preset-format YAML file under

nemoclaw-blueprint/policies/presets/

, for example

nemoclaw-blueprint/policies/presets/influxdb.yaml

yaml

preset:
  name: influxdb
  description: "InfluxDB time-series database"
network_policies:
  influxdb:
    name: influxdb
    endpoints:
      - host: influxdb.internal.example.com
        port: 8086
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/api/v2/write" }
    binaries:
      - { path: /usr/bin/curl }

Apply it to the running sandbox:
console
```
$ nemoclaw my-assistant policy-add
```
NemoClaw reads the live policy via
```
openshell policy get --full
```
, structurally merges your preset's
```
network_policies
```
into it, and writes the merged result back. Existing presets and the baseline remain in place. The preset file under
```
presets/
```
also persists across sandbox recreations.

这是无损修改路径，也是NemoClaw原生支持的唯一将新条目合并到运行中策略的流程。

在

nemoclaw-blueprint/policies/presets/

下创建预设格式的YAML文件，例如

nemoclaw-blueprint/policies/presets/influxdb.yaml

：

yaml

preset:
  name: influxdb
  description: "InfluxDB time-series database"
network_policies:
  influxdb:
    name: influxdb
    endpoints:
      - host: influxdb.internal.example.com
        port: 8086
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/api/v2/write" }
    binaries:
      - { path: /usr/bin/curl }

将其应用到运行中的沙箱：
console
```
$ nemoclaw my-assistant policy-add
```
NemoClaw会通过
```
openshell policy get --full
```
读取实时策略，将你的预设
```
network_policies
```
结构化合并到其中，然后将合并结果写回。现有预设和基线策略会保留。
```
presets/
```
下的预设文件也会在沙箱重新创建时持久化。

Option 2: Snapshot, Edit, and Set via OpenShell

选项2：快照、编辑并通过OpenShell设置

Use this path only when you cannot add a file under the NemoClaw source tree. You must start from the live policy, not from

openclaw-sandbox.yaml

, so the presets layered on at onboarding are preserved in the file you apply.

console

$ openshell policy get --full my-assistant > live-policy.yaml

Edit

live-policy.yaml

to add your entries under

network_policies:

, keeping the existing

version

field intact, then apply:

console

$ openshell policy set --policy live-policy.yaml my-assistant

仅当无法在NemoClaw源码目录下添加文件时使用此路径。必须从实时策略开始，而非

openclaw-sandbox.yaml

，这样Onboarding期间叠加的预设才会保留在你应用的文件中。

console

$ openshell policy get --full my-assistant > live-policy.yaml

编辑

live-policy.yaml

，在

network_policies:

下添加条目，保留现有

version

字段不变，然后应用：

console

$ openshell policy set --policy live-policy.yaml my-assistant

Scope of Dynamic Changes

动态修改的作用范围

Dynamic changes apply only to the current session. When the sandbox stops, the running policy resets to the baseline composed from

openclaw-sandbox.yaml

plus the presets recorded for the sandbox. To make a custom policy survive a sandbox recreation, ship the preset file in the repository (Option 1 above — the file under

presets/

persists) or edit

openclaw-sandbox.yaml

and re-run

nemoclaw onboard

动态修改仅对当前会话生效。当沙箱停止时，运行策略会重置为

openclaw-sandbox.yaml

基线策略加上沙箱记录的预设组成的版本。要使自定义策略在沙箱重新创建后仍生效，请将预设文件存入仓库（上述选项1——

presets/

下的文件会持久化），或编辑

openclaw-sandbox.yaml

并重新运行

nemoclaw onboard

。

Approve Requests Interactively

交互式批准请求

For one-off access, you can approve blocked requests in the OpenShell TUI instead of editing the baseline policy:

console

$ openshell term

This is useful when you want to test a destination before deciding whether it belongs in a permanent preset or custom policy file.

对于一次性访问需求，你可以在OpenShell TUI中批准被拦截的请求，无需编辑基线策略：

console

$ openshell term

这适用于在决定是否将目标地址纳入永久预设或自定义策略文件之前进行测试的场景。

Policy Presets

策略预设

NemoClaw ships preset policy files for common integrations in

nemoclaw-blueprint/policies/presets/

. Apply a preset as-is or use it as a starting template for a custom policy. For guided post-install examples, see Common Integration Policy Examples (use the

nemoclaw-user-manage-policy

skill).

During onboarding, the policy tier (use the

nemoclaw-user-reference

skill) you select determines which presets are enabled by default. You can add or remove individual presets in the interactive preset screen that follows tier selection.

Available presets:

Preset	Endpoints
`brave`	Brave Search API
`brew`	Homebrew (Linuxbrew) package manager
`discord`	Discord API, gateway, and CDN access
`github`	GitHub and GitHub REST API
`huggingface`	Hugging Face Hub (download-only) and inference router
`jira`	Atlassian Jira API
`local-inference`	Local Ollama and vLLM through the host gateway
`npm`	npm and Yarn registries
`outlook`	Microsoft 365 and Outlook
`pypi`	Python Package Index
`slack`	Slack API and webhooks
`telegram`	Telegram Bot API
`whatsapp`	WhatsApp Web messaging

To apply a preset to a running sandbox:

console

$ nemoclaw <name> policy-add

Note:

Preset selection is interactive when you omit a preset name. Pass a preset name with

--yes

for scripted workflows.

For example, to interactively add PyPI access to a running sandbox:

console

$ nemoclaw my-assistant policy-add

To list which presets are applied to a sandbox:

console

$ nemoclaw <name> policy-list

To include a preset in the baseline, merge its entries into

openclaw-sandbox.yaml

and re-run

nemoclaw onboard

Note:

The

openshell policy set --policy <file> <sandbox-name>

command operates on raw policy files and does not accept the

preset:

metadata block used in preset YAML files. Use

nemoclaw <name> policy-add

for presets.

For scripted workflows,

policy-add

and

policy-remove

accept the preset name as a positional argument:

console

$ nemoclaw my-assistant policy-add pypi --yes
$ nemoclaw my-assistant policy-remove pypi --yes

Set

NEMOCLAW_NON_INTERACTIVE=1

instead of

--yes

to drive the same flow from an environment variable. See Commands (use the

nemoclaw-user-reference

skill) for the full flag reference.

nemoclaw <name> rebuild

reapplies every policy preset to the recreated sandbox, so presets survive an agent-version upgrade without manual reapplication.

NemoClaw在

nemoclaw-blueprint/policies/presets/

中提供了常见集成的预设策略文件。可直接应用预设，或以此为模板创建自定义策略。如需安装后的引导式示例，请使用

nemoclaw-user-manage-policy

技能查看「常见集成策略示例」。

在Onboarding期间，你选择的策略层级（使用

nemoclaw-user-reference

技能查看）会决定默认启用哪些预设。在层级选择后的交互式预设界面中，你可以添加或移除单个预设。

可用预设：

预设	端点
`brave`	Brave Search API
`brew`	Homebrew（Linuxbrew）包管理器
`discord`	Discord API、网关和CDN访问
`github`	GitHub及GitHub REST API
`huggingface`	Hugging Face Hub（仅下载）和推理路由
`jira`	Atlassian Jira API
`local-inference`	通过主机网关访问本地Ollama和vLLM
`npm`	npm和Yarn注册表
`outlook`	Microsoft 365和Outlook
`pypi`	Python Package Index
`slack`	Slack API和Webhooks
`telegram`	Telegram Bot API
`whatsapp`	WhatsApp Web消息

要对运行中的沙箱应用预设：

console

$ nemoclaw <name> policy-add

注意：

省略预设名称时，预设选择为交互式。在脚本化工作流中，可通过

--yes

参数传入预设名称。

例如，交互式为运行中的沙箱添加PyPI访问权限：

console

$ nemoclaw my-assistant policy-add

要列出沙箱已应用的预设：

console

$ nemoclaw <name> policy-list

要将预设纳入基线策略，请将其条目合并到

openclaw-sandbox.yaml

并重新运行

nemoclaw onboard

。

注意：

openshell policy set --policy <file> <sandbox-name>

命令针对原始策略文件操作，不接受预设YAML文件中使用的

preset:

元数据块。请使用

nemoclaw <name> policy-add

命令处理预设。

在脚本化工作流中，

policy-add

和

policy-remove

接受预设名称作为位置参数：

console

$ nemoclaw my-assistant policy-add pypi --yes
$ nemoclaw my-assistant policy-remove pypi --yes

也可通过设置环境变量

NEMOCLAW_NON_INTERACTIVE=1

替代

--yes

参数，实现相同的工作流。如需完整的参数参考，请使用

nemoclaw-user-reference

技能查看「命令」相关内容。

nemoclaw <name> rebuild

会将所有策略预设重新应用到重新创建的沙箱，因此预设可在Agent版本升级后自动保留，无需手动重新应用。

Custom Preset Files

自定义预设文件

Apply a user-authored preset YAML to a running sandbox without editing the baseline or dropping to

openshell policy set

可将用户编写的预设YAML应用到运行中的沙箱，无需编辑基线策略或使用

openshell policy set

命令。

Authoring

编写规范

A custom preset follows the same shape as the built-in ones under

nemoclaw-blueprint/policies/presets/

yaml

preset:
  name: my-internal-api
  description: "Internal service"
network_policies:
  my-internal-api:
    name: my-internal-api
    endpoints:
      - host: api.example.internal
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
    binaries:
      - { path: /usr/local/bin/node }

The top-level

preset.name

must be a lowercase RFC 1123 label (letters, digits, hyphens) and must not collide with a built-in preset name such as

slack

pypi

. Rename

preset.name

if NemoClaw refuses to apply the file because of a collision.

自定义预设遵循

nemoclaw-blueprint/policies/presets/

下内置预设的相同格式：

yaml

preset:
  name: my-internal-api
  description: "Internal service"
network_policies:
  my-internal-api:
    name: my-internal-api
    endpoints:
      - host: api.example.internal
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
    binaries:
      - { path: /usr/local/bin/node }

顶层

preset.name

必须是小写的RFC 1123标签（字母、数字、连字符），且不能与

slack

或

pypi

等内置预设名称冲突。如果NemoClaw因名称冲突拒绝应用文件，请重命名

preset.name

。

Apply a Single File

应用单个文件

console

$ nemoclaw my-assistant policy-add --from-file ./presets/my-internal-api.yaml

Preview the endpoints without applying with

--dry-run

, and skip the confirmation prompt with

--yes

or by exporting

NEMOCLAW_NON_INTERACTIVE=1

console

$ nemoclaw my-assistant policy-add --from-file ./presets/my-internal-api.yaml

使用

--dry-run

参数可预览端点而不实际应用，使用

--yes

参数或导出

NEMOCLAW_NON_INTERACTIVE=1

可跳过确认提示。

Apply Every File in a Directory

应用目录下所有文件

console

$ nemoclaw my-assistant policy-add --from-dir ./presets/ --yes

Files are processed in lexicographic order. Processing stops at the first failure; presets already applied are not rolled back. Fix the failing file and re-run the command to continue.

Warning:

Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations. Review every host in a custom preset before applying it, especially when the file originates outside your team.

console

$ nemoclaw my-assistant policy-add --from-dir ./presets/ --yes

文件按字典序处理。处理过程中遇到第一个失败时会停止，已应用的预设不会回滚。修复失败的文件后重新运行命令即可继续。

警告：

自定义预设主机可绕过NemoClaw的审核流程，可能将沙箱出站范围扩大到任意目标地址。应用前请审核自定义预设中的每一个主机，尤其是文件来自团队外部的情况。

Remove a Custom Preset

移除自定义预设

Custom presets applied with

--from-file

--from-dir

are recorded in the NemoClaw sandbox registry alongside their full YAML content, so they can be removed by name — the original file does not need to be kept on disk:

console

$ nemoclaw my-assistant policy-remove my-internal-api --yes

policy-remove

accepts both built-in and custom preset names. Run

nemoclaw <name> policy-list

to see every preset currently applied to the sandbox.

通过

--from-file

或

--from-dir

应用的自定义预设会连同完整YAML内容一起记录在NemoClaw沙箱注册表中，因此可通过名称移除——无需保留原始文件：

console

$ nemoclaw my-assistant policy-remove my-internal-api --yes

policy-remove

接受内置预设和自定义预设名称。运行

nemoclaw <name> policy-list

可查看沙箱当前已应用的所有预设。

References

参考资料

references/integration-policy-examples.md — Guides users through common post-install integration policy setup for maintained NemoClaw policy presets, including Outlook, messaging channels, GitHub, Jira, Brave Search, package managers, Hugging Face, local inference, and OpenShell approval workflows.
Load references/approve-network-requests.md when approving or denying sandbox egress requests, managing blocked network calls, or using the approval TUI. Reviews and approves blocked agent network requests in the TUI.

references/integration-policy-examples.md — 引导用户完成NemoClaw维护的策略预设的常见安装后集成策略设置，包括Outlook、消息渠道、GitHub、Jira、Brave Search、包管理器、Hugging Face、本地推理和OpenShell审批工作流。
如需批准或拒绝沙箱出站请求、管理被拦截的网络调用或使用审批TUI，请查看references/approve-network-requests.md。该文档介绍了如何在TUI中审核和批准被拦截的Agent网络请求。

nemoclaw-user-manage-policy

Original

Translation

Customize the Sandbox Network Policy

自定义沙箱网络策略

Gotchas

注意事项

Prerequisites

前提条件

Static Changes

静态修改

Edit the Policy File

编辑策略文件

Re-Run Onboard

重新运行Onboard向导

Verify the Policy

验证策略

Add Blueprint Policy Additions

添加蓝图策略扩展

Dynamic Changes

动态修改

Option 1: Drop a Preset File and Use policy-add (Recommended)

选项1：添加预设文件并使用policy-add（推荐）

Option 2: Snapshot, Edit, and Set via OpenShell

选项2：快照、编辑并通过OpenShell设置

Scope of Dynamic Changes

动态修改的作用范围

Approve Requests Interactively

交互式批准请求

Policy Presets

策略预设

Custom Preset Files

自定义预设文件

Authoring

编写规范

Apply a Single File

应用单个文件

Apply Every File in a Directory

应用目录下所有文件

Remove a Custom Preset

移除自定义预设

References

参考资料

Related Skills

相关技能

Option 1: Drop a Preset File and Use
`policy-add`
(Recommended)

选项1：添加预设文件并使用
`policy-add`
（推荐）