NemoClaw: Nvidia's Enterprise Agent Security Stack

This is a living signal post. The body evolves as the technology develops. Snapshots preserve each significant update.

What’s New This Week

NemoClaw launched at GTC 2026 on March 16. This post will track how Nvidia’s enterprise agent security stack develops and how the OpenShell architecture shapes enterprise AI agent deployment.

Changelog

What NemoClaw Is

OpenClaw is the fastest-growing open source project in history. Jensen Huang’s description at GTC 2026: “OpenClaw is the operating system for personal AI. This is the moment the industry has been waiting for – the beginning of a new renaissance in software.” It runs locally, takes autonomous action on your behalf, and leverages frontier models – Claude and ChatGPT – rather than running its own.

The problem is that a locally-running autonomous agent that can access your files, browser, email, and terminal is, as ZDNET framed it, a security nightmare by default. OpenClaw gives agents capability. It does not, out of the box, give enterprises control.

NemoClaw is Nvidia’s answer to that gap.

It is a single-command install. Run it, and you get two things: NVIDIA Nemotron models running locally on your hardware, and the NVIDIA OpenShell runtime sitting beneath your agents. That combination – local inference plus a policy-enforcing sandbox – is the architecture Nvidia is betting enterprises need to actually deploy autonomous agents at scale.

Peter Steinberger, OpenClaw’s creator: “With NVIDIA and the broader ecosystem, we’re building the claws and guardrails that let anyone create powerful, secure AI assistants.”

Hardware targets span the full Nvidia stack: RTX PCs and laptops, RTX PRO workstations, DGX Station, and DGX Spark AI supercomputers. Cloud and on-premises. The same software stack, different compute.

The Architecture: Below the Agent Layer

The framing Nvidia uses is precise and worth taking seriously: NemoClaw provides “the missing infrastructure layer beneath claws to give them the access they need to be productive, while enforcing policy-based security, network and privacy guardrails.”

Below the agent layer. Not at the prompt level. Not in the model. At the infrastructure level.

This matters because security at the prompt level is fragile. System prompts get overridden. Jailbreaks exist. Models can be manipulated into ignoring instructions. None of that is unique to OpenClaw – it’s inherent to language models.

Security at the infrastructure level is different in kind. OpenShell is an open-source runtime that enforces policy-based guardrails before an agent can act. The sandbox isolates what agents can reach. Permission boundaries are defined by the organisation, not by the model, not by the prompt. An agent that is not allowed to exfiltrate data cannot exfiltrate data, regardless of what it is instructed to do at the model level.

This is the same principle that makes operating system security meaningful. A process running as an unprivileged user cannot escalate its own privileges no matter what it is told to compute. NemoClaw applies that principle to agents.

Organisation-defined permission and privacy settings are enforced at this layer. That means IT and security teams can define what agents can and cannot do before any model runs. The enforcement is structural, not instructional.

The Local/Cloud Hybrid Model

NemoClaw runs two classes of model in combination.

Nemotron models run locally, on device. For tasks that involve sensitive data – internal documents, customer records, anything the organisation needs to keep contained – the model never leaves the hardware. No data goes to a third-party API. The inference happens on the RTX or DGX hardware the organisation already controls.

Frontier models – Claude, ChatGPT – are accessible via a privacy router. The router handles requests to cloud models while applying the organisation’s privacy settings. What gets sent out, and in what form, is governed by policy. Sensitive fields can be stripped or masked before a request leaves the network.

This is a meaningful architectural choice for enterprise data governance. The hard requirement for most regulated industries is not “no cloud models ever” – it is “sensitive data never reaches an external API uncontrolled.” The privacy router gives organisations a mechanism to use frontier model capability without abandoning data governance controls.

It also means NemoClaw does not force a choice between capability and control. Local Nemotron for private data. Frontier models, through a governed channel, for tasks that benefit from their capability. The policy layer decides which model sees which data.

Why This Matters for Enterprise Agent Adoption

The blocker for enterprises adopting AI agents is not capability. OpenClaw, unaided, is already capable of taking consequential autonomous action. The blocker is control. Who decides what agents can do? How does the organisation enforce that at scale? What happens when an agent does something it should not?

These questions have blocked enterprise deployment of autonomous agents more than any model limitation. Capability arrived before the governance infrastructure to support it.

NemoClaw is Nvidia’s answer to the control question. It shifts the conversation from “should we let agents do this?” to “here is the infrastructure that defines and enforces what agents can do.” That is a more tractable problem for enterprise security and compliance teams.

The related post on agent pipeline hardening covers the architectural principles in detail. NemoClaw is, in effect, those principles productised by the dominant hardware vendor in AI infrastructure. That matters for adoption velocity.

The broader context is at the agentic turn – the shift from AI as a tool you query to AI as infrastructure that acts. NemoClaw is a sign that the industry is taking the infrastructure part seriously.

What OpenShell Changes

OpenShell is open source. That is not an incidental detail.

A proprietary guardrail runtime would lock enterprises into Nvidia’s stack. An open-source one can be adopted, audited, extended, and – potentially – implemented by other agent platforms. Whether OpenShell becomes the de facto standard for agent security infrastructure depends on whether other platforms adopt it or build competing approaches.

The precedent that matters here is containerd, or perhaps more precisely, the OCI spec. Container runtimes were once fragmented. A standard emerged not because one vendor won, but because the specification became the thing everyone implemented. If OpenShell’s architecture proves sound and enterprise adoption is meaningful, other agent platforms have an incentive to adopt or align with it.

What to watch: whether non-Nvidia agent platforms – or agent orchestration layers – ship OpenShell integration. If that happens, OpenShell stops being a Nvidia technology and becomes an industry standard.

The local inference parallel is also worth noting. Mistral Small 4 and similar models are making capable local inference accessible across a much wider hardware base than Nvidia’s top-tier stack. If OpenShell becomes the standard guardrail runtime, it may need to run on hardware well beyond DGX.

The Competitive Context

NemoClaw is not the only attempt to add enterprise controls to autonomous agents.

Agent Safehouse – referenced in the state-of-AI post – is an earlier approach to the same problem: sandboxing agents so they cannot take unintended actions. The architectures differ, and it is not yet clear which approach will prove more robust in production.

The broader competitive dynamic: every major vendor with a stake in enterprise AI deployment has an interest in the agent security layer. Microsoft has Azure AI guardrails. Google has equivalent infrastructure for Vertex AI agents. What is different about NemoClaw is that it targets OpenClaw specifically – the open-source platform that is growing fastest – and that OpenShell is positioned as an open-source runtime rather than a cloud-vendor-specific control plane.

That positioning makes sense given Nvidia’s business. Nvidia sells hardware. An open-source software stack that makes enterprises comfortable deploying agents on Nvidia hardware is aligned with Nvidia’s interests regardless of which cloud or which model the agents use.

What to Watch

Real enterprise deployments. Announced architecture is not production evidence. The signal becomes stronger when specific enterprises report deploying OpenClaw with NemoClaw at scale, with specific policy configurations and observable outcomes.

OpenShell adoption beyond Nvidia. If other agent platforms ship OpenShell support, the architecture has legs beyond Nvidia’s customer base. If it stays Nvidia-only, it is a differentiation play rather than an infrastructure standard.

Regulatory alignment. The EU AI Act creates compliance requirements for certain categories of AI system. Whether NemoClaw’s policy layer and audit capabilities satisfy those requirements – and whether Nvidia positions it explicitly for compliance – will influence enterprise adoption in regulated markets.

The privacy router in practice. The architectural claim is that sensitive data can reach frontier model capability without leaving the organisation’s control. That claim will be tested when enterprises try to use it for real workflows with real data. The edge cases matter.

Competition from below. If capable local models run on commodity hardware – without requiring RTX or DGX – the hardware tie-in weakens. NemoClaw’s software stack remains relevant, but the addressable market for the full stack narrows.

What goes wrong when agents are not controlled is documented at ai-agents-rogue. NemoClaw is an attempt to prevent exactly those failure modes from reaching production. Whether the architecture holds is the question this signal exists to answer.