The NVIDIA GTC announcement of the NemoClaw stack addresses one of the real reasons enterprises haven’t deployed AI agents at scale — and one vendor’s alternative to address those concerns.
OpenClaw became the fastest-growing open-source project in history while enterprise buyers watched from the sidelines.
Not because the technology wasn’t interesting. It is. Not because employees weren’t already using it. They were — quietly, on personal machines, sometimes on corporate devices. Enterprises held back because an autonomous AI agent that can access file systems, execute code, log into corporate systems, and communicate externally is not something you hand to 10,000 employees without a security framework underneath it.
NVIDIA ‘s NemoClaw announcement at GTC 2026 offers one solution to address that gap directly. It is not a competitor to OpenClaw. It is a reference stack that adds the infrastructure layer OpenClaw was missing: policy-based security guardrails, a privacy router, a sandboxed runtime called OpenShell, and integration with the security tools enterprises already use, installed in a single command.
Jensen Huang put it plainly in his GTC keynote:
“Agentic systems in the corporate network can have access to sensitive information. They can execute code and communicate externally. You could access employee information, access supply chain, access finance information, and send it out. Obviously, this can’t possibly be allowed.”
For enterprise buyers, this is the right framing. The question was never whether AI agents would be useful. The question was whether they could be deployed safely inside an enterprise environment. NemoClaw is NVIDIA’s answer to that question for OpenClaw.
Why OpenClaw Alone Wasn’t Enterprise-Ready
Before discussing what NemoClaw adds, it is worth clarifying the enterprise IT and security leader’s concerns.
OpenClaw is designed to act like a digital assistant sitting at your computer. It can view your screen, control your browser, open files, execute commands, and log in to websites. If an employee grants OpenClaw access, it operates the computer the same way the employee would. That means if the employee can access corporate email, CRM systems, internal dashboards, customer data, or finance systems, the tool can access them too.
The issue is not the AI itself. The issue is how much access the software has and where the data goes afterward. Specific risks enterprises were managing before NemoClaw include:
- Credential exposure. If OpenClaw interacts with browser sessions or system logins, it can gain access to saved passwords, session tokens, and authentication cookies. This could allow the tool — or anything that compromises it — to impersonate the employee in corporate systems.
- Data leaving the organization. AI automation tools often send information to external services for processing. That can include screenshots, text from documents, browser content, and system commands. If sensitive enterprise data is transmitted outside approved systems, it may violate GDPR, HIPAA, PCI, or data-residency requirements across multiple jurisdictions.
- Autonomous actions without audit trails. AI agents can operate autonomously, executing workflows, interacting with websites, and performing transactions without logging. If poorly configured, an agent could send emails, download files, update records, or trigger business workflows without IT or compliance teams having visibility.
- Shadow IT at scale. Meta instructed employees not to use OpenClaw on work computers due to security concerns. Many companies followed suit. Even so, adoption continued. Prohibition alone does not work when the tool is genuinely useful. Enterprises need a sanctioned, controlled alternative or safeguards— not just a policy.
What NemoClaw Actually Does
NemoClaw is not a product. It is a reference stack — an open-source configuration of existing and new NVIDIA tools that installs on top of OpenClaw to add the enterprise infrastructure layer. Here is what each component does:
- OpenShell. This is the core of the security layer. OpenShell runs OpenClaw agents in an isolated sandbox that limits what files they can access and restricts network connectivity. Enterprises can write policy rules in YAML to define exactly which systems an agent can access, which data it can process, and which actions require human approval. YAML Ain’t Markup Language (YAML) is a human-friendly, plain-text format used to store data, configure software, or move data between systems. Some rules are hot-swappable, allowing them to be changed without restarting the agent.
- Privacy Router. When agents need to call cloud-based frontier models, the Privacy Router ensures sensitive enterprise data is not transmitted to those external models. This is the mechanism that makes hybrid local-cloud architectures viable without creating data residency exposure.
- Nemotron Models. NVIDIA’s open model family can run locally on dedicated hardware, including NVIDIA RTX PCs and DGX Station. Running inference locally means sensitive enterprise data stays on-premises for tasks that require it. This also reduces cloud inference costs. NVIDIA reports that its hybrid architecture — using Nemotron for research tasks and frontier models for orchestration — can cut query costs by more than 50 percent.
- Single-command installation. This matters more than it sounds. One practical barrier to enterprise AI deployment is configuration complexity. A stack that requires days of professional services to stand up will not achieve broad adoption. NemoClaw installs the entire reference configuration in one command.
Kari Briski, NVIDIA’s VP of Generative AI Software, described it this way at GTC: OpenShell “provides the missing infrastructure layer beneath claws to give them the access they need to be productive, while enforcing policy-based security, network, and privacy guardrails.”
That framing is accurate. The productivity value of OpenClaw was never in question. What was missing was the control layer.
The SaaS Ecosystem Is Already Moving
For enterprise buyers, the breadth of the partner ecosystem matters as much as the technology itself. You are not just evaluating a security sandbox. You are evaluating whether the tools your teams already use will work within that sandbox.
The list of software companies integrating with NVIDIA Agent Toolkit and OpenShell includes Adobe, Atlassian, Box, Cisco, CrowdStrike, Red Hat, Salesforce, SAP, ServiceNow, and Siemens. A few specific integrations are worth noting:
- Cisco‘s AI Defense will provide AI security protection for OpenShell, adding controls and guardrails to govern agent actions. For enterprises already running Cisco security infrastructure, this is a direct integration path.
- CrowdStrike unveiled a Secure-by-Design AI Blueprint that embeds Falcon platform protection directly into NVIDIA AI agent architectures. Enterprises with CrowdStrike endpoint protection can extend that coverage to AI agents.
- Salesforce is working with Agent Toolkit to enable customers to build and deploy AI agents through Agentforce for service, sales, and marketing tasks, using Slack as the conversational interface and orchestration layer. This matters because Salesforce and Slack are already inside most enterprises.
- ServiceNow ’s Autonomous Workforce of AI Specialists is built on Agent Toolkit and includes NVIDIA Nemotron models. ServiceNow is the workflow backbone for IT operations in many large enterprises, which means agentic AI is now moving into ITSM and operational workflows directly.
- SAP is using Agent Toolkit to enable AI agents through Joule Studio on SAP Business Technology Platform, allowing customers to design agents tailored to specific business processes. For enterprises running SAP as their ERP backbone, this is a direct integration with operational data.
The pattern here is important. These are not experimental integrations. Salesforce, ServiceNow, and SAP together represent the core of enterprise application infrastructure. When your existing SaaS platforms build their agentic strategies on the same security and identity stack, it significantly reduces the interoperability problem. You are not assembling a security architecture from scratch for every new AI agent. You are extending an existing framework.
It is also worth noting that NVIDIA is collaborating with Microsoft Security, Google , CrowdStrike, and TrendAI to build OpenShell compatibility with their security tools. The intent is to make OpenShell work within security stacks enterprises already have, not replace them.
What This Means for CIOs and Enterprise Buyers
NemoClaw does not eliminate the work required to deploy AI agents safely. It reduces the barrier significantly. Before evaluating whether NemoClaw belongs in your environment, three questions are worth resolving:
Are employees already using OpenClaw? If the answer is yes — even informally — then the risk exists today. NemoClaw gives you a sanctioned path to bring that activity under enterprise controls rather than competing with shadow IT through prohibition.
Is your identity framework ready for AI agents? NemoClaw provides the guardrails, but agents still need registered identities and role-based access controls. Most enterprise identity frameworks were designed for people. Before deploying agents at scale, confirm that your identity infrastructure can assign, manage, and revoke agent credentials separately from human credentials.
Do you have the observability to know if agents are working correctly? OpenShell provides audit logging and network guardrails. That is a starting point, not a complete observability stack. You need monitoring in place to detect when agents are drifting, making errors, or accessing systems they should not.
The Caveats That Curb My Enthusiasm
The broader context here matters. Jensen Huang framed the OpenClaw moment as equivalent to the arrival of Linux, HTML, and Kubernetes — foundational infrastructure that reorganized entire industries. That may or may not prove accurate.
What is accurate is that agentic AI as a category, not just OpenClaw, will fundamentally change enterprise workflow platforms. The companies that define their governance architecture now will be better positioned than those that build it under pressure later.
It is also worth being realistic about what NemoClaw does not solve. Cross-vendor agent orchestration remains complex. An agent working in Salesforce does not automatically collaborate with an agent in SAP without significant integration work. Governance frameworks for multi-agent systems are still nascent. The tools are improving faster than the enterprise readiness in most organizations.
Other things to consider. NemoClaw and OpenShell are open source. Anyone can download them. However, to run Nemotron models locally (the privacy-preserving option that keeps data on-premises), you need NVIDIA GPU hardware — an RTX PC, DGX Spark, or DGX Station.
YAML policy configuration is an IT burden. Enterprises customize OpenShell by writing YAML rules. That’s a developer-friendly approach, not an enterprise admin-friendly one. Large organizations with thousands of use cases will need tooling and staffing to manage that policy layer. This is not point-and-click governance.
The partner ecosystem is announced, not proven. The list of SaaS partners — Salesforce, SAP, ServiceNow, etc. — represents intent and roadmap, not certified integrations. Most of these are “working with NVIDIA” statements. Before betting enterprise deployments on them, buyers should ask specifically what is shipping, when, and what certification or testing has been completed.
Start with Governance, Not the Agent
NemoClaw is genuinely useful for enterprise buyers. It addresses the right problem in the right way — by adding enterprise security controls to an open-source agent platform that employees are already adopting, rather than building a competing proprietary stack.
The partner ecosystem — particularly Salesforce, ServiceNow, SAP, Cisco, and CrowdStrike — means NemoClaw is not a greenfield deployment for most enterprises. It fits into the existing infrastructure.
But the technology being ready does not mean you are ready. Before deploying agents in any production environment, define what they are allowed to do, what data they can access, and how you will know when something goes wrong. That work is not optional — and no reference stack does it for you.
Governance first. Agents second. That is the sequence that works.
Subscribe to my AI with Maribel Lopez podcast on your channel of choice here.







