The XERXES design principle is to reuse good upstream work while documenting the operational gaps that matter to self-hosted multi-agent systems.
OpenClaw now supports multiple sandbox backends and explicit hardening controls, but it documents the default as a single trusted operator with sandboxing off. That is a configuration boundary, not proof of an inherently insecure product. OpenClaw trust boundary ↗
Network, filesystem, process and inference protections, with live network exceptions. These are legitimate controls; Clawsolator does not claim to replace their kernel enforcement. Its aim is broader operational orchestration and operator experience. NemoClaw security layers ↗
Rootless Podman, multi-office organization, automatic within-policy resource grants, guided setup, audit and escalation planning. Implemented, demonstrated and planned controls must remain labeled separately. Examine the daemon ↗
OpenClaw is a useful integration today. OpenShell, Hermes or a future XERXES harness can fit beneath a framework-independent governance architecture when tested and approved. SIDE development platform ↗
We see recurring design patterns across agent projects. These observations describe engineering tradeoffs, not allegations that any unnamed project is defective.
The interface lets users change settings but does not establish who may request changes or who executes them.
A container is called “isolated” while mounting secrets, broad home directories or the container engine socket.
A master agent inherits direct access to the machine in the name of convenience.
Operators are asked for permission after the harmful operation has already happened.
Teams rewrite browser tools, PDF engines, sandboxes, schedulers or communication stacks that already work.
A UI reports “secure” because a config key exists, even when enforcement is missing.
OpenShell and NemoClaw already implement substantial security controls. The claim is not that they are security-free. It's that the complete Clawsolator/XMAN operating workflow has not been established as equivalent in the public materials reviewed.
SOURCE · NVIDIA OpenShell controls · SOURCE · NVIDIA NemoClaw posture · SOURCE · OpenClaw hardening model
If it has a measurable gap, build exactly what is missing.
OpenClaw already supports sandboxing and security audits. Its own documentation describes one trusted operator boundary per gateway; mixed-trust deployments require deliberate separation.
Read the official security model ↗NVIDIA's tooling implements real network, filesystem, process and inference enforcement. This is substantial existing security technology that Clawsolator may integrate, not pretend to supersede.
Review enforcement layers ↗Our product direction connects isolated agent execution with easier lifecycle management, guided setup, bounded resource requests, operator approvals, recovery and multiple business domains. Integration does not remove the need for independent testing.
See the setup walkthrough →NVIDIA OpenShell documents gateway-mediated policy, an external supervisor, logging and live network approvals. NemoClaw documents deny-by-default egress. Clawsolator and XMAN are being built around guided deployment, multi-office workflows, rootless Podman governance and independent resource decisions. The difference is scope and integration—not a claim that other tools have no security.
| Approach | Documented strength | Where XMAN focuses |
|---|---|---|
| OpenClaw | Extensive tools, community, audits and configurable sandboxing; one documented trust boundary per gateway. | Independent resource governance, guided isolation, operational approval workflows and framework interchangeability. |
| NVIDIA OpenShell | Gateway, sandbox supervisor, network policy enforcement, live approval and auditable decisions. | Use alongside established sandbox controls; concentrate on orchestration, rootless Podman deployment and user-facing system lifecycle. |
| NVIDIA NemoClaw | OpenClaw-oriented sandbox onboarding and deny-by-default egress, with live approval for unlisted endpoints. | Keep optional components replaceable while offering additional use-case-oriented deployment workflows. |
| Clawsolator / XMAN | Demonstrated bounded Podman resource authorization and readback; ongoing platform integration. | Enterprise-friendly operator experience, multiple secure domains, human review and reproducible policy evidence. |
NVIDIA OpenShell architecture ↗ NemoClaw policies ↗ NVIDIA security bulletin ↗
OpenShell provides concrete agent sandbox and policy capabilities. Clawsolator’s target is a broader operator-facing management layer: guided installation, rootless container lifecycle, scoped resources, domain organization, approvals and multiple agent frameworks. They may also be complementary rather than exclusive.
Yes. NemoClaw incorporates OpenShell-related isolation and policy features. A useful comparison should examine exact supported versions and operations instead of claiming it lacks sandboxing.
Compare isolation boundaries, network policy, secrets management, human approval, audit evidence, recovery, upgrades, runtime cost and support for independently governed business domains. Demand reproducible tests rather than accepting generic claims of “secure AI.”