Does NemoClaw Make WorkingAgents Irrelevant?

NVIDIA announced NemoClaw at GTC 2026 with OpenShell, a security runtime that enforces sandboxing, least-privilege access controls, and policy-based governance for AI agents. The question is fair: if NVIDIA now provides agent governance, what’s left for WorkingAgents?

The short answer: NemoClaw and WorkingAgents govern different things at different levels. NemoClaw sandboxes the agent’s runtime environment. WorkingAgents governs what the agent does with enterprise tools, data, and services. They’re complementary layers, not replacements for each other.

Here’s the detailed breakdown.

What NemoClaw’s OpenShell Actually Does

OpenShell is a sandbox runtime. It controls four domains via declarative YAML policies:

Domain	What it controls	Example
Filesystem	Which paths the agent process can read/write	Agent can access `/data/reports/` but not `/etc/secrets/`
Network	Which hosts/ports the agent can reach	Agent can call `api.anthropic.com:443` but not `evil.com`
Process	What system calls the agent can make	Block privilege escalation, dangerous syscalls
Inference	Which model endpoints the agent can call	Reroute model API calls to controlled backends

This is infrastructure-level isolation. Think of it as a container security policy for AI agents. The agent runs inside a sandbox where it physically cannot access files, networks, or processes outside its allowed scope.

What OpenShell does well:

Prevents a compromised agent from escaping its sandbox
Blocks unauthorized network connections (data exfiltration at the network level)
Enforces least-privilege at the OS/process level
YAML policies are hot-reloadable for network and inference rules
Open-source (Apache 2.0), free, backed by NVIDIA

What OpenShell Does NOT Do

OpenShell operates at the infrastructure layer. It doesn’t understand what the agent is doing at the application layer. Here’s what’s missing:

No per-user, per-role permission model

OpenShell policies are per-sandbox, not per-user. A sandbox is configured with a set of allowed paths, hosts, and syscalls. All agents running in that sandbox get the same permissions.

WorkingAgents enforces permissions per user. Agent A acting on behalf of a junior account manager sees different tools than Agent A acting on behalf of the VP. Same agent, different permissions, determined by the human’s identity. OpenShell has no concept of user identity at the permission level.

No tool-call-level governance

OpenShell controls whether the agent can reach a network endpoint. It doesn’t control what the agent does once it connects.

An agent allowed to reach the CRM API can call any CRM endpoint – list contacts, delete contacts, export the entire database. OpenShell can’t distinguish between GET /contacts/123 and DELETE /contacts/123. Both are network connections to the same host.

WorkingAgents gates every individual tool call. nis_get_contact is a different permission from nis_delete_contact. A user with read access can’t delete. A user with delete access triggers an audit log entry. The governance happens at the action level, not the network level.

No audit trail on tool arguments and results

OpenShell logs policy violations – “agent tried to access blocked path” or “agent tried to reach blocked host.” It doesn’t log what the agent sent to allowed endpoints or what came back.

WorkingAgents logs every tool call with the full context: who triggered it, what tool was called, what arguments were sent, what result was returned, how long it took. When a regulator asks “what did the agent do with the customer data?”, the answer requires application-level logging, not network-level logging.

No model-agnostic governance

NemoClaw is built around NVIDIA’s stack – Nemotron models, NIM inference services, NVIDIA hardware optimization. OpenShell’s inference policies reroute model calls to controlled backends, but those backends are expected to be NVIDIA-aligned.

Enterprises running Claude, GPT-4, Gemini, Mistral, or mixed-model strategies need governance that works across all providers. OpenShell doesn’t provide cross-provider model routing, cost-based selection, or multi-vendor audit trails.

No business logic awareness

OpenShell sees files, network connections, and processes. It doesn’t see CRM records, financial transactions, patient data, or sales pipelines. It can’t enforce “agents can read contacts but not modify deal values” because it doesn’t understand what a deal value is.

WorkingAgents’ permission model is built around business operations – 86+ tools covering CRM, task management, knowledge base, scheduling, monitoring, email, and messaging. Each tool has its own permission key. The governance understands the business context, not just the infrastructure.

No budget or cost control

OpenShell doesn’t track API costs, token consumption, or budget limits. An agent that makes 10,000 model API calls through an allowed network endpoint runs up whatever bill it wants.

Early alpha status

NVIDIA explicitly warns that NemoClaw is in early alpha as of March 2026. 73% of agent experiments falter on production integration. Limited model access and no automatic failover mean an agent stops working if its model endpoint goes down.

The Layer Diagram

                        What governs it?

Agent Process         OpenShell
  |                     - filesystem access
  |                     - network access
  |                     - process privileges
  |                     - inference routing
  |
  v
Enterprise Tools      WorkingAgents
  |                     - per-user permissions
  |                     - per-tool access control
  |                     - argument validation
  |                     - result inspection
  |                     - audit trail (who, what, when, why)
  |                     - rate limiting
  |                     - cost tracking
  |                     - sequence detection
  |
  v
Business Data         WorkingAgents
                        - PII redaction
                        - data boundary enforcement
                        - compliance logging
                        - budget control

OpenShell answers: “Can this agent process reach this resource?” WorkingAgents answers: “Can this user’s agent perform this specific action on this specific data?”

Both are necessary. Neither replaces the other.

A Concrete Example

A healthcare company deploys an AI agent to help physicians review patient records.

What OpenShell provides:

Agent sandbox can only reach the hospital’s internal APIs (network policy)
Agent can’t read files outside /app/data/ (filesystem policy)
Agent can’t escalate privileges or spawn unauthorized processes
Model calls route to the hospital’s on-premises NVIDIA NIM endpoint

What OpenShell cannot provide:

Dr. Smith can access her own patients’ records but not Dr. Jones’s patients
The agent can read patient summaries but cannot modify treatment plans
Every patient record access is logged with the physician’s identity for HIPAA
The agent cannot forward patient data to an external email address (OpenShell blocks the network, but what if the allowed internal email system is used?)
The agent’s total API cost is capped at $50/day per physician
If the agent reads 20 patient records and then calls the email tool, the sequence is flagged as potential data exfiltration

What WorkingAgents provides for all of the above:

Per-user permission keys: Dr. Smith’s agent inherits Dr. Smith’s access scope
Tool-level governance: patient_summary_read is a different permission from treatment_plan_modify
HIPAA-compliant audit trail: every tool call logged with physician identity, patient ID (redacted in logs), timestamp, and action
Sequence detection: bulk record reads followed by communication tool calls trigger an alert
Budget enforcement: daily cost cap per user
PII redaction: patient identifiers stripped before data leaves the governed perimeter

The Competitive Reality

NemoClaw doesn’t make WorkingAgents irrelevant. It makes the agent infrastructure layer more secure, which is good for everyone. A more secure sandbox means a stronger foundation for application-level governance to build on.

NemoClaw is infrastructure governance. It secures the computing environment. WorkingAgents is application governance. It secures the business operations.

If anything, NemoClaw validates the market. NVIDIA doesn’t build products for imaginary problems. The fact that a $3 trillion company is investing in agent governance confirms that the governance gap is real. What NemoClaw doesn’t cover – per-user permissions, tool-call-level audit trails, business-logic-aware access control, cross-provider model governance – is exactly where WorkingAgents operates.

The strongest positioning: WorkingAgents runs on top of NemoClaw. Agents execute inside OpenShell sandboxes (infrastructure security) and access enterprise tools through WorkingAgents’ MCP Gateway (application security). Two layers, two concerns, both necessary.

What Would Make NemoClaw a Threat

NemoClaw becomes a direct threat to WorkingAgents if NVIDIA adds:

Per-user identity-aware permissions at the tool level (not just sandbox level)
Tool-call-level audit logging with full argument/result capture
Business-domain-specific governance (CRM permissions, financial data boundaries, HIPAA logging)
Cross-provider model routing (not just NVIDIA models)
Cost tracking and budget enforcement per user per session

These are application-layer features. NVIDIA’s history suggests they’re more likely to partner with companies that provide this layer than to build it themselves. NVIDIA sells GPUs and inference. Granular CRM permission models are not their core competency.

But watch the roadmap. If NemoClaw’s next release adds identity-aware tool-call governance, the conversation changes.

Bottom Line

NemoClaw secures the sandbox. WorkingAgents secures the actions. An enterprise deploying AI agents needs both – the same way a building needs both locked doors (infrastructure) and access badges with room-level permissions (application).

OpenShell’s YAML policies can’t express “Dr. Smith can read patient summaries but not modify treatment plans.” WorkingAgents’ permission keys can. That’s not a gap NVIDIA is likely to close, because it requires domain-specific business logic that changes with every customer.

WorkingAgents is not irrelevant. It’s the layer that NemoClaw doesn’t provide and probably won’t.

Sources: