Runtime guardrails for NemoClaw agents (security recipe now in nemoclaw-community)

[Habirua]

Hey all we recently got a security recipe merged into nemoclaw-community and wanted to share it here for anyone running agents that can actually do things (shell, SQL, MCP tools, messaging other agents).

The recipe adds a governance check in the agent loop: tool calls, MCP calls, and responses get evaluated against a policy before they execute, and come back as allow / warn / require-approval / block. The agent reads the verdict and adjusts instead of just erroring out. The part we spent the most review rounds on was making the check something the agent can't reason its way around it sits server-side in the loop, not in the system prompt.

Recipe: https://github.com/NVIDIA/nemoclaw-community/tree/main/examples/recipes/partners/shrike/shrike-security
Design walkthrough (why it's built this way): https://shrikesecurity.com/blog/securing-nemoclaw-agents

It went through a multi-round security review from the maintainers before merging, which honestly made it better — the secret-handling in the gateway flow got reworked entirely because of it.

Happy to answer questions if anyone tries it with their setup. Curious what other people are doing for guardrails on agents with real tool access.