Securing Agents · Going Further

Going Further

By now you have built an agent loop from scratch, put it behind a kernel-level sandbox, and measured the blast radius the policy leaves.

A real deployment adds its own data and users. You now need to choose where to deploy it, how to bring in your own knowledge, and which open problems matter once the basics hold.

Deploy what you built

Moving the exercises onto a real runtime

The in-browser exercises were sized for learning, with proxied endpoints and sessions that reset between runs. Taking the same work to a persistent deployment means choosing a runtime, an inference provider, and an operating model for long-running sessions. Hosted endpoints require no learner-managed GPU; local inference requirements depend on the selected provider and model.

NemoClaw's current prerequisites list general Linux, macOS, Windows through WSL2, and DGX Spark paths. The baseline starts at 4 vCPU and 8 GB RAM; GPU is optional. Check the current documentation as requirements and interfaces evolve.
build.nvidia.com hosts OpenAI-compatible endpoints for every NVIDIA-hosted model. The Python and JS examples in this course paste in here unchanged; swap the baseURL from your launchable's proxy to https://integrate.api.nvidia.com/v1 and supply an NVIDIA API key. Account access and quota follow the current service terms.
NemoClaw applications is the companion gallery for the launchable you ran. NVIDIA's DGX Spark playbooks walk complete NemoClaw agents end to end, including a daily news digest, a software-development agent, a deck reviewer, and a calendar negotiator, each carrying the same policy setup Module 4 covered. Read one as a worked blueprint for the always-on agent you packaged in Module 3.
Self-host with NIM when the model needs to run on-prem or in your VPC. NVIDIA Inference Microservices package the model, tokenizer, and an OpenAI-compatible HTTP server into one container. The Persona, Tooled, and ReAct agents in Modules 1 and 2 ship unchanged against a NIM endpoint.
Frameworks worth comparing: LangGraph for typed state machines, the deepagents npm package for the planner, VFS, and sub-agents shape from 2c, plus CrewAI and AutoGen for role-based fleets. Compare each framework by the work it makes explicit: state, tools, retrieval, delegation, persistence, and runtime policy.

Carry the interface forward

The browser artifact is a transferable agent surface

Each course page is both a lesson and a small application. The interface exposes state, controls, intermediate results, and approval points; JavaScript runs the local orchestration. That combination works well when the audience has a browser but no prepared development environment. It can explain a system interactively, drive a dynamic workflow, or provide a focused front end for general scripting over loaded data and allowed services.

Transfer the interface contract, then adapt the environment. HTML, CSS, JavaScript, visible state, and approval controls travel well. Authentication, cross-origin access, persistence, filesystem reach, backend tools, and host UI bridges do not. Keep those dependencies behind narrow adapters so the workflow can move without pretending every host grants the same authority.

Agent products now expose this form directly. Anthropic describes Cowork live artifacts as persistent interactive HTML pages that can refresh from connected apps and local files. OpenAI's preview Apps SDK lets an MCP-backed app define its chat behavior and interactive interface together. A static page, a hosted artifact, and an in-chat app use different host contracts, but all can present the same workflow as inspectable state plus bounded actions.

Add new knowledge

Bringing your data in

The Index Agent in Module 2b ran against a small in-page corpus. A production deployment needs more work and considerations, so the following references may be of interest.

NeMo Retriever is the production successor to the cosine similarity retrieval from Module 2b. Sparse keyword search and dense vector search run in parallel and their scores are merged, a reranker re-orders the candidates by relevance, and configurable chunking primitives let you control how documents are split before indexing. Pair it with NIM-served embeddings for a fully on-prem retrieval stack that keeps data inside your VPC.
NVIDIA AI Blueprints give reference implementations for common agent shapes: a RAG chatbot, a multimodal PDF extractor, a research assistant. Each blueprint is the Research Agent (2c) configuration for one domain, fully deployable. They work both as starting templates and as a sanity check on your own architecture.
NeMo Data Curator treats bringing your own corpus in cleanly as a project of its own. It handles deduplication, language filtering, PII removal, and exact-match scoring at the scales where doing it by hand stops working. Retrieval quality compounds on data quality, so cleaning the corpus once pays off across every query the agent ever makes against it.
NeMo Guardrails adds programmable input and output filters, topic policies, and fact-checks that run at the application layer, above the model. It complements kernel containment without replacing it: the two layers catch different failure classes, and you want both running together.

Applied · NextChoose the next production axis to deepen?

Where to push next

Where production work diverges

Production projects usually deepen one of these areas:

The knowledge layer. Production-grade retrieval: structural chunking, page-image retrieval, faithfulness eval on real heterogeneous corpora. NeMo Retriever and the RAG AI Blueprints are where this gets built for real.
The substrate. Wire-format protocols (MCP, the Responses API, OTel GenAI conventions, A2A) that keep tool capabilities portable across providers and frameworks.
Fleet dynamics and containment. What changes when N agents run in parallel: each agent redundantly re-discovers the same context (rediscovery cost), topologies with too many hops lose coherence, and an agent grading a peer's output can shift its verdicts based on social context rather than content. How to bound any single agent in the fleet with kernel-level containment (Landlock, seccomp, network namespaces) when prompt rules and guardrails are not enough to limit blast radius.

Pick the axis that matches the problem your current project keeps running into. The NVIDIA Developer Blog tracks the latest reference work across them.

NVIDIA Developer Blog →

Deep · SourcesOpen the full module-by-module reading list?

References hub

Reading list, organised by module

This hub gathers every source the modules' "References" tails point back to, and every entry is freely available through arxiv or the org's own docs and GitHub repositories.

The topic groups follow this course first, then extend into fleet and evaluation work.

Module 1 · Model and agent foundations

Russell & Norvig (2020). Artificial Intelligence: A Modern Approach, 4th ed. Where the PEAS framework and agent taxonomy live.
Bratman (1987). Intention, Plans, and Practical Reason (the BDI tuple; summary).
Vaswani et al. (2017). Attention Is All You Need. arXiv:1706.03762. The transformer.
Sennrich et al. (2015). Neural Machine Translation of Rare Words with Subword Units. arXiv:1508.07909. BPE tokenisation.
Brown et al. (2020). Language Models are Few-Shot Learners. arXiv:2005.14165. Introduces in-context learning.
Wei et al. (2022). Chain-of-Thought Prompting Elicits Reasoning in LLMs. arXiv:2201.11903.
Park et al. (2023). Generative Agents. arXiv:2304.03442 (referenced across M1c, M4, M6).

Module 1 · ReAct, tool use, and structured outputs

Willard & Louf (2023). Efficient Guided Generation for LLMs. arXiv:2307.09702. The FSM theory behind Outlines.
Schick et al. (2023). Toolformer. arXiv:2302.04761 (self-supervised tool use).
Yao et al. (2022). ReAct: Synergizing Reasoning and Acting in LLMs. arXiv:2210.03629. Module 1b's figure is redrawn from this.
OpenAI Structured Outputs · function calling.
Anthropic tool-use reference.
Model Context Protocol · Outlines · XGrammar.
JSON Schema draft 2020-12 spec.

Module 2 · Workflow, retrieval, and deep research

Xu et al. (2023). ReWOO: Decoupling Reasoning from Observations. arXiv:2305.18323.
Wang et al. (2023). Plan-and-Solve Prompting. arXiv:2305.04091.
Madaan et al. (2023). Self-Refine. arXiv:2303.17651.
Lewis et al. (2020). Retrieval-Augmented Generation. arXiv:2005.11401. Module 2b's figure is redrawn from this.
Karpukhin et al. (2020). Dense Passage Retrieval. arXiv:2004.04906.
Johnson, Douze, Jégou (2017). Billion-scale similarity search with GPUs arXiv:1702.08734 (FAISS).
Gao et al. (2022). HyDE. arXiv:2212.10496.
Hsieh et al. (2024). RULER. arXiv:2404.06654 (long-context benchmark).
Wang et al. (2023). Voyager. arXiv:2305.16291.
LangChain Deep Agents · deepagents · LangGraph.

Module 3 · Persistent runtimes and CLI agents

Packer et al. (2023). MemGPT. arXiv:2310.08560.
Karpas et al. (2022). MRKL Systems. arXiv:2205.00445.
Liu et al. (2023). Lost in the Middle. arXiv:2307.03172. Long-context degradation; motivates compaction.
Park et al. (2023). Generative Agents. arXiv:2304.03442.
Wang et al. (2023). Voyager. arXiv:2305.16291 (always-on skill-library agent).
Anthropic Claude Code · Agent Skills.
OpenAI Codex CLI.
Hermes Agent (Nous Research) and its security guide. A separate agent application with skills from experience, persistent memory, built-in cron, and a messaging gateway; useful when comparing agent applications with the OpenShell security runtime and the NemoClaw reference stack.
NeMo Curator (data-quality pipeline).

Module 4 · Evaluation and containment

OpenTelemetry GenAI semantic conventions.
Zheng et al. (2023). Judging LLM-as-a-Judge with MT-Bench. arXiv:2306.05685.
Liu et al. (2023). G-Eval. arXiv:2303.16634.
Liang et al. (2022). Holistic Evaluation of Language Models (HELM). arXiv:2211.09110.
Saad-Falcon et al. (2024). ARES: Automated Eval for RAG. arXiv:2403.02419.
Greshake et al. (2023). Not what you've signed up for. arXiv:2302.12173 (indirect prompt injection).
Inan et al. (2023). Llama Guard. arXiv:2312.06674.
Willison (2025). The lethal trifecta.
OWASP GenAI Top 10 · Landlock · seccomp-BPF.
NeMo Guardrails · LangSmith · Arize Phoenix · Jaeger.

Beyond this course: the final group extends the same design questions to fleets and model adaptation.

Going further · Multi-agent systems and adaptation

Cemri et al. (2025). Why Do Multi-Agent LLM Systems Fail? (MAST). arXiv:2503.13657.
Wu et al. (2023). AutoGen. arXiv:2308.08155.
Hong et al. (2023). MetaGPT. arXiv:2308.00352.
Chen et al. (2024). Are More LLM Calls All You Need? Towards Scaling Laws of Compound Inference Systems arXiv:2403.02419.
Xu et al. (2025). A-MEM: Atomic Notes for Agent Memory. arXiv:2502.12110.
Christiano et al. (2017). Deep RL from Human Preferences (RLHF). arXiv:1706.03741.
Rafailov et al. (2023). Direct Preference Optimization (DPO). arXiv:2305.18290.
Bai et al. (2022). Constitutional AI. arXiv:2212.08073.
NVIDIA AI-Q Blueprint · deepagents.

Learning path

Continue with the NVIDIA Agentic AI Learning Path

This course is the hands-on companion to Lesson 6 of NVIDIA's Agentic AI Learning Path, How to Build a Safer Autonomous Agent using OpenClaw. The full path begins with building a first agent and ends at the safety work this course covers in depth. In between it moves through retrieval, evaluation, model customization, and deep agents that delegate and persist memory. Each lesson below pairs a concept you met here with the place the path develops it further.

Lesson 1 · How to Build an AI Agent

The plan-act-observe loop you built from scratch in Module 1, here assembled with NVIDIA Nemotron models and LangGraph into a report-generation agent.

Start →

Lesson 2 · How to Build an Agentic RAG Application

The retrieval agent from Module 2b, scaled up: dense and sparse search, reranking, and a vector store wired into a ReAct agent that plans its own queries.

Start →

Lesson 3 · How to Evaluate AI Agents

The verification half of the loop. Measuring task success, tool-use quality, and trajectory efficiency with RAGAS metrics and LLM-as-judge pipelines, the discipline behind every reliability decision in this course.

Start →

Lesson 4 · How to Customize AI Agents

When prompting and skills hit their limit, this lesson writes domain knowledge into the weights themselves: synthetic data with NeMo Data Designer, then fine-tuning Nemotron with GRPO and LoRA.

Start →

Lesson 5 · How to Build Deep AI Agents

The planner, sub-agent delegation, and virtual-filesystem memory you hand-rolled in Module 2c, built here with LangChain's deepagents library and the NVIDIA AI-Q Blueprint.

Start →

Lesson 6 · How to Build a Safer Autonomous Agent using OpenClaw

This course. The containment work from Modules 3 and 4: deny-by-default network, Landlock filesystem, seccomp hardening, credential isolation, and continuous safety evaluation on a long-running claw.

Start →

Helper articles worth reading

What Is Agentic AI? The plain-language definition the whole path starts from: reasoning and iterative planning to solve multi-step problems autonomously.
Deep Agents glossary Names the four pillars (planning, sub-agent delegation, filesystem memory, skills) that separate a deep agent from the shallow ReAct loop, the same split Module 2c draws.
Traditional RAG vs. agentic RAG Why an agent that plans its own retrieval beats a single fixed lookup, the reasoning behind the Index Agent in Module 2b.
Run autonomous agents more safely with NVIDIA OpenShell The OpenShell sandbox layer that backs the kernel-level containment you study in Modules 3 and 4.
Build a secure always-on local AI agent with NemoClaw A step-by-step install of NemoClaw on DGX Spark, showing how the reference stack assembles OpenClaw, OpenShell, policy, and local inference end to end.
What OpenClaw agents mean for every organization When to reach for a long-running claw on your own infrastructure rather than a one-shot prompt, the design question Module 4 keeps returning to.

What you actually built

The course built a harness around a swappable model

The model never changed across these modules. The same frozen and stateless model that filled the reasoning slot in Module 1 is the one running under the deep agent, the OpenClaw persona, and the sandboxed claw.

Everything else you wrote is the harness, the system that wraps a raw model and makes it useful for sustained, autonomous work. Each module added one layer of it.

The loop. Module 1 turned a single chat call into an agent by wrapping it in a cycle that calls a tool, feeds the result back, and runs again until the model is done. That cycle is the execution layer, the part a runtime like OpenClaw or a framework like LangGraph gives you so you do not hand-roll it.
The workflow. Module 2 scoped what each stage could see and how results moved between fixed pipelines, retrieval, and research branches. Choosing what to fold in and what to keep out is context engineering, and it shapes output quality at least as much as the wording of any one prompt (Weng, 2023).
The runtime. Module 3 moved those workflows into OpenClaw, where gateway sessions, workspace files, skills, and schedules persist beyond a browser call.
The containment. Module 4 added the layer that does not read the prompt at all. OpenShell enforces its rules at the syscall boundary, so a successful injection still cannot exceed the policy.

Your engineering accumulates in these layers rather than in the model itself. A stronger model drops into the same harness with little rework, so you carry these layers forward across upgrades.

When an agent keeps failing the same way, the gap is usually a layer you have not built yet, and a check enforced beneath it fixes the failure more durably than another pass at the prompt. The patterns below show what that work looks like in practice.

Lessons for deployment

What to remember when you ship one of these

Forecasts about agent productivity are systematically wrong. METR's randomised trial of experienced open-source developers found a meaningful slowdown from using a coding agent, even though they expected to go faster and reported afterward that they had. That distance between forecast and measured result is the finding to carry forward, so weigh it when scoping the value of any agent you ship.
A single strong agent is the default. A single strong agent beats a multi-agent system once a task crosses a threshold of complexity (Chen et al., 2024). Push N higher and the emergent behaviours can hurt more than the failure modes you set out to fix. Before adding one more to the topology, name the specific failure mode it is meant to fix. If you can't name it, the extra complexity is unlikely to help.
Kernel containment answers what survives a successful prompt injection. Prompt rules and application guardrails help, but they only act on what the model exposes to them, and an injected instruction that looks valid will pass straight through.

Any agent that can touch a real shell or filesystem or reach the network therefore needs a layer beneath the prompt. That layer enforces its rules at the syscall boundary, below the level any instruction can reach.
The agent's admin token is a higher perimeter than the sandbox. The kernel sandbox bounds what the agent can do to the world, yet it says nothing about whoever holds the agent's operator token. That holder sits above the boundary entirely, free to do any of the following:
- read the persona
- plant cron jobs
- patch the model and its tools
- inject a turn into the conversation
The hardness of the box and the scope of that token are separate measurements.

Module 4b showed the token reaching past the checkpoint the sandbox never sees. Treat an operator.admin credential like a root password: tight storage and regular rotation. For that agent it reaches further than root does inside the box.

Keep the Course Assistant with you

The Course Assistant behind the ✦ button is available on every English lesson, so this page no longer mounts a second capstone chat. It preloads the current page. When a question crosses modules, the assistant can inspect the course map, search the lessons, and read the relevant pages. Browser-local persistence means sessions stay in this browser: return to one after navigating or reloading, or create another for a clean line of inquiry. As a session grows, the assistant compacts older turns into durable memory, keeps the recent exchange verbatim, and starts a fresh bounded agent thread from that state.

The shape you built runs in production. The OpenClaw agent you drove in Modules 3 and 4 is built on the Pi agent runtime which OpenClaw leverages behind its agent gateway. Looking at this core, you'll see that under all of these layers is the same perceive-reason-act loop, tool calls, and growing message history you relied on in Module 1.

← Module 4b: Modern CLIs ↩ Back to course home