Going Further
A real deployment adds its own data and users. You now need to choose where to deploy it, how to bring in your own knowledge, and which open problems matter once the basics hold.
Moving the exercises onto a real runtime
Continue with the NemoClaw Brev launchable used in Module 3. If you cannot use Brev, a compatible local deployment is the fallback. For either option, choose a model endpoint and decide how to retain sessions and workspace files.
- Local fallback. Check NemoClaw's current prerequisites before installing the stack on your own host, because requirements and interfaces evolve. The documented minimum is 4 vCPU, 8 GB RAM, and 20 GB of free disk space. A GPU is optional when using hosted inference. For local inference, also check the selected model's hardware requirements.
-
build.nvidia.com
provides model endpoints. This course uses the model route you configure.
For a separate deployment, configure
baseURLashttps://integrate.api.nvidia.com/v1and supply an NVIDIA API key. Verify the selected model's interface, account access, and quota under the current service terms. - NemoClaw applications is the companion gallery for the launchable you ran. NVIDIA's DGX Spark playbooks walk complete NemoClaw agents end to end, including a daily news digest, a software-development agent, a deck reviewer, and a calendar negotiator. Inspect each playbook's policy and runtime requirements before adapting the agent you operated in Module 3.
- Self-host with NIM when the model needs to run on-prem or in your VPC. NVIDIA Inference Microservices package the model, tokenizer, and an OpenAI-compatible HTTP server into one container. The Persona, Tooled, and ReAct agents in Modules 1 and 2 can use a compatible NIM endpoint after you verify its model, tool-call, and structured-output support.
-
Frameworks worth comparing:
LangGraph
for typed state machines, the
deepagentsnpm package for the planner, VFS, and sub-agents shape from 2c, plus CrewAI and AutoGen for role-based fleets. Compare each framework by the work it makes explicit: state, tools, retrieval, delegation, persistence, and runtime policy.
The browser artifact is a transferable agent surface
Each course page is both a lesson and a small application. The interface exposes state, controls, intermediate results, and approval points; JavaScript runs the local orchestration. That combination works well when the audience has a browser but no prepared development environment. It can explain a system interactively, drive a dynamic workflow, or provide a focused front end for general scripting over loaded data and allowed services.
Agent products now expose this form directly. Anthropic describes Cowork live artifacts as persistent interactive HTML pages that can refresh from connected apps and local files. OpenAI's preview Apps SDK lets an MCP-backed app define its chat behavior and interactive interface together. A static page, a hosted artifact, and an in-chat app use different host contracts, but all can present the same workflow as inspectable state plus bounded actions.
Bringing your data in
The Index Agent in Module 2b ran against a small in-page corpus. A production deployment needs more work and considerations, so the following references may be of interest.
- NeMo Retriever provides retrieval components beyond Module 2b's in-memory cosine search. Sparse keyword search and dense vector search run in parallel and their scores are merged, a reranker re-orders the candidates by relevance, and configurable chunking primitives let you control how documents are split before indexing. Pair it with NIM-served embeddings and choose where to host the retrieval stack and its data.
- NVIDIA AI Blueprints provide reference implementations for different workflows. Compare their requirements and architecture with the planner, tools, and memory from Module 2c before adapting one.
- NeMo Data Curator provides corpus preparation tools such as deduplication and filtering. Evaluate cleanup against your retrieval tasks; it does not guarantee that every answer improves.
- NeMo Guardrails adds programmable input and output filters, topic policies, and fact-checks that run at the application layer, above the model. It complements kernel containment without replacing it: the two layers catch different failure classes, and you want both running together.
Choose the next production axis to deepen?
Where production work diverges
Production projects usually deepen one of these areas:
- The knowledge layer. Evaluate structural chunking, page-image retrieval, and answer faithfulness on the different kinds of documents in your corpus.
- The substrate. Wire-format protocols (MCP, the Responses API, OTel GenAI conventions, A2A) that keep tool capabilities portable across providers and frameworks.
- Fleet dynamics and containment. What changes when N agents run in parallel: each agent redundantly re-discovers the same context (rediscovery cost), topologies with too many hops lose coherence, and an agent grading a peer's output can shift its verdicts based on social context rather than content. How to bound any single agent in the fleet with kernel-level containment (Landlock, seccomp, network namespaces) when prompt rules and guardrails are not enough to limit blast radius.
Pick the axis that matches the problem your current project keeps running into. The NVIDIA Developer Blog tracks the latest reference work across them.
NVIDIA Developer Blog →Open the full module-by-module reading list?
Reading list, organised by module
These references extend the module reading lists. Papers and documentation may be freely accessible; some books require purchase or institutional access.
The topic groups follow this course first, then extend into fleet and evaluation work.
Module 1 · Model and agent foundations
- Russell & Norvig (2020). Artificial Intelligence: A Modern Approach, 4th ed. Where the PEAS framework and agent taxonomy live.
- Bratman (1987). Intention, Plans, and Practical Reason (the BDI tuple; summary).
- Vaswani et al. (2017). Attention Is All You Need.
arXiv:1706.03762. The transformer. - Sennrich et al. (2015). Neural Machine Translation of Rare Words with Subword Units.
arXiv:1508.07909. BPE tokenisation. - Brown et al. (2020). Language Models are Few-Shot Learners.
arXiv:2005.14165. Introduces in-context learning. - Wei et al. (2022). Chain-of-Thought Prompting Elicits Reasoning in LLMs.
arXiv:2201.11903. - Park et al. (2023). Generative Agents.
arXiv:2304.03442(referenced across M1c, M4, M6).
Module 1 · ReAct, tool use, and structured outputs
- Willard & Louf (2023). Efficient Guided Generation for LLMs.
arXiv:2307.09702. The FSM theory behind Outlines. - Schick et al. (2023). Toolformer.
arXiv:2302.04761(self-supervised tool use). - Yao et al. (2022). ReAct: Synergizing Reasoning and Acting in LLMs.
arXiv:2210.03629. Module 1b's figure is redrawn from this. - OpenAI Structured Outputs · function calling.
- Anthropic tool-use reference.
- Model Context Protocol · Outlines · XGrammar.
- JSON Schema draft 2020-12 spec.
Module 2 · Workflow, retrieval, and deep research
- Xu et al. (2023). ReWOO: Decoupling Reasoning from Observations.
arXiv:2305.18323. - Wang et al. (2023). Plan-and-Solve Prompting.
arXiv:2305.04091. - Madaan et al. (2023). Self-Refine.
arXiv:2303.17651. - Lewis et al. (2020). Retrieval-Augmented Generation.
arXiv:2005.11401. Module 2b's figure is redrawn from this. - Karpukhin et al. (2020). Dense Passage Retrieval.
arXiv:2004.04906. - Johnson, Douze, Jégou (2017). Billion-scale similarity search with GPUs
arXiv:1702.08734(FAISS). - Gao et al. (2022). HyDE.
arXiv:2212.10496. - Hsieh et al. (2024). RULER.
arXiv:2404.06654(long-context benchmark). - Wang et al. (2023). Voyager.
arXiv:2305.16291. - LangChain Deep Agents · deepagents · LangGraph.
Module 3 · Persistent runtimes and CLI agents
- Packer et al. (2023). MemGPT.
arXiv:2310.08560. - Karpas et al. (2022). MRKL Systems.
arXiv:2205.00445. - Liu et al. (2023). Lost in the Middle.
arXiv:2307.03172. Long-context degradation; motivates compaction. - Park et al. (2023). Generative Agents.
arXiv:2304.03442. - Wang et al. (2023). Voyager.
arXiv:2305.16291(always-on skill-library agent). - Anthropic Claude Code · Agent Skills.
- OpenAI Codex CLI.
- Hermes Agent (Nous Research) and its security guide. A separate agent application with skills from experience, persistent memory, built-in cron, and a messaging gateway; useful when comparing agent applications with the OpenShell security runtime and the NemoClaw reference stack.
- NeMo Curator (data-quality pipeline).
Module 4 · Evaluation and containment
- OpenTelemetry GenAI semantic conventions.
- Zheng et al. (2023). Judging LLM-as-a-Judge with MT-Bench.
arXiv:2306.05685. - Liu et al. (2023). G-Eval.
arXiv:2303.16634. - Liang et al. (2022). Holistic Evaluation of Language Models (HELM).
arXiv:2211.09110. - Saad-Falcon et al. (2023). ARES: An Automated Evaluation Framework for Retrieval-Augmented Generation Systems.
arXiv:2311.09476. - Greshake et al. (2023). Not what you've signed up for.
arXiv:2302.12173(indirect prompt injection). - Inan et al. (2023). Llama Guard.
arXiv:2312.06674. - Willison (2025). The lethal trifecta.
- OWASP GenAI Top 10 · Landlock · seccomp-BPF.
- NeMo Guardrails · LangSmith · Arize Phoenix · Jaeger.
Beyond this course: the final group extends the same design questions to fleets and model adaptation.
Going further · Multi-agent systems and adaptation
- Cemri et al. (2025). Why Do Multi-Agent LLM Systems Fail? (MAST).
arXiv:2503.13657. - Wu et al. (2023). AutoGen.
arXiv:2308.08155. - Hong et al. (2023). MetaGPT.
arXiv:2308.00352. - Chen et al. (2024). Are More LLM Calls All You Need? Towards Scaling Laws of Compound Inference Systems
arXiv:2403.02419. - Xu et al. (2025). A-MEM: Atomic Notes for Agent Memory.
arXiv:2502.12110. - Christiano et al. (2017). Deep RL from Human Preferences (RLHF).
arXiv:1706.03741. - Rafailov et al. (2023). Direct Preference Optimization (DPO).
arXiv:2305.18290. - Bai et al. (2022). Constitutional AI.
arXiv:2212.08073. - NVIDIA AI-Q Blueprint · deepagents.
Continue with the NVIDIA Agentic AI Learning Path
This course is the hands-on companion to Lesson 6 of NVIDIA's Agentic AI Learning Path, How to Build a Safer Autonomous Agent using OpenClaw. The full path begins with building a first agent and ends at the safety work this course covers in depth. In between it moves through retrieval, evaluation, model customization, and deep agents that delegate and persist memory. Each lesson below pairs a concept you met here with the place the path develops it further.
Lesson 1 · How to Build an AI Agent
The plan-act-observe loop you built from scratch in Module 1, here assembled with NVIDIA Nemotron models and LangGraph into a report-generation agent.
Start →Lesson 2 · How to Build an Agentic RAG Application
The retrieval agent from Module 2b, scaled up: dense and sparse search, reranking, and a vector store wired into a ReAct agent that plans its own queries.
Start →Lesson 3 · How to Evaluate AI Agents
The verification half of the loop. Measuring task success, tool-use quality, and trajectory efficiency with RAGAS metrics and LLM-as-judge pipelines, the discipline behind every reliability decision in this course.
Start →Lesson 4 · How to Customize AI Agents
When prompting and skills hit their limit, this lesson writes domain knowledge into the weights themselves: synthetic data with NeMo Data Designer, then fine-tuning Nemotron with GRPO and LoRA.
Start →Lesson 5 · How to Build Deep AI Agents
The planner, sub-agent delegation, and virtual-filesystem memory you hand-rolled in Module 2c, built here with LangChain's deepagents library and the NVIDIA AI-Q Blueprint.
Start →Lesson 6 · How to Build a Safer Autonomous Agent using OpenClaw
This course. The containment work from Modules 3 and 4: deny-by-default network, Landlock filesystem, seccomp hardening, credential isolation, and continuous safety evaluation on a long-running claw.
Start →Helper articles worth reading
- What Is Agentic AI? The plain-language definition the whole path starts from: reasoning and iterative planning to solve multi-step problems autonomously.
- Deep Agents glossary Names the four pillars (planning, sub-agent delegation, filesystem memory, skills) that separate a deep agent from the shallow ReAct loop, the same split Module 2c draws.
- Traditional RAG vs. agentic RAG compares fixed retrieval with an agent choosing retrieval steps. Evaluate quality, cost, and failures on your task.
- Run autonomous agents more safely with NVIDIA OpenShell The OpenShell sandbox layer that backs the kernel-level containment you study in Modules 3 and 4.
- Build a secure always-on local AI agent with NemoClaw A step-by-step install of NemoClaw on DGX Spark, showing how the reference stack assembles OpenClaw, OpenShell, policy, and local inference end to end.
- What OpenClaw agents mean for every organization When to reach for a long-running claw on your own infrastructure rather than a one-shot prompt, the design question Module 4 keeps returning to.
Connect the loop, workflow, runtime, and policy
The browser model route and the persistent agent runtime are configured separately. Their models can differ. The reusable part is the surrounding orchestration, whose behavior still needs testing with the model you choose.
- The loop. Module 1 turned a single chat call into an agent by wrapping it in a cycle that calls a tool, feeds the result back, and runs again until the model is done. That cycle is the execution layer, the part a runtime like OpenClaw or a framework like LangGraph gives you so you do not hand-roll it.
- The workflow. Module 2 compared fixed pipelines, retrieval, and research branches. Evaluate context selection and prompt wording against the same task and evidence.
- The runtime. Module 3 moved those workflows into OpenClaw, where gateway sessions, workspace files, skills, and schedules persist beyond a browser call.
- The containment. Module 4 examined restrictions on files, network access, and process operations. Their effect depends on active policy and enforcement; harmful use of allowed capabilities remains possible.
These layers can carry forward across model upgrades. Retest tool arguments, output formats, context limits, cancellation, and task results on the replacement endpoint before relying on the same behavior.
When an agent repeatedly fails, inspect its inputs, model responses, tool results, and runtime constraints to locate the cause. Choose the repair from that evidence. The deployment considerations below provide further questions to test.
What to remember when you ship one of these
-
Measure productivity on the work you intend to automate. METR's early-2025 randomised trial of experienced open-source developers found a meaningful slowdown from using a coding agent, even though they expected to go faster and reported afterward that they had. That result describes the tools, developers, and work studied at that time. Compare forecasts with measurements on your own task and current tools.
-
Measure the value of additional model calls. Chen et al. (2024) studied repeated-call voting and filtering. On their studied tasks, adding calls could improve results and then reduce them. That finding does not determine the best agent architecture for your task. Measure whether an added call or agent fixes a specific failure and whether its benefit justifies its cost.
-
Test application checks and runtime permissions. Requests that pass application checks can still cause harm. Evaluate both the handling of untrusted instructions and the capabilities available to the agent.
Use independent execution controls when a workflow can read sensitive data, change files, or communicate externally. Verify that those controls apply to each execution path.
-
Check administrative authority separately. The read survey in Module 4a tests selected methods with the current token. Write authority depends on its scope and the gateway configuration. Inspect those grants and protect the credential; read success alone does not establish control over the agent.
Keep the Course Assistant with you
The Course Assistant behind the ✦ button is available on every English lesson. It preloads the current page. When a question crosses modules, the assistant can inspect the course map, search the lessons, and read the relevant pages. Browser-local persistence means sessions stay in this browser: return to one after navigating or reloading, or create another for a clean line of inquiry. As a session grows, the assistant compacts older turns into durable memory, keeps the recent exchange verbatim, and starts a fresh bounded agent thread from that state.
Finish the course
Checking your verified course progress.