NemoClaw in one sentence: It wraps OpenClaw inside NVIDIA OpenShell (Landlock + seccomp + network namespaces — the isolation boundary), then runs a transparent inference-routing proxy: the agent calls
inference.local, the OpenShell gateway intercepts before the packet leaves the sandbox, injects the real credential host-side, and forwards to Nemotron — so the agent holds no credentials. The kernel mechanisms isolate; the inference proxy is the part nobody else has.