The Swif OpenShell Sandbox Policy sets one Swif-managed policy for the NVIDIA OpenShell sandboxes on a device. OpenShell runs AI agents, such as Claude Code, OpenCode, or OpenClaw, in isolated sandboxes. This policy controls what those agents can reach:

Swif applies the policy to every local OpenShell gateway on the device, so it covers every sandbox there, including sandboxes created later. Users can't change it from inside a sandbox.

Important: Anything you don't list is blocked. When the policy is enabled, sandboxed agents can only reach the hosts in Network Access and Model Endpoints. This includes model APIs that OpenShell providers would otherwise allow. If both lists are empty, agents can't reach the network or any model at all. List every destination and model endpoint your agents need before you turn on Enabled.

Not covered:

A new policy version is applied at the agent's next policy check, which runs every 20 minutes.

About restart: files in the sandbox's home directory are kept, but running agent sessions end, and /tmp is cleared. Use report if users may be in the middle of agent sessions, and restart sandboxes at a convenient time.

About the check interval: the check runs with the agent's 20-minute policy check, so 20 minutes is the shortest interval.

Paths sandboxed agents can read and write. Every other path is inaccessible.

System paths are always included. OpenShell needs these to run, so Swif always adds them, unless you list them with different access:

Paths must be absolute and can't contain ...

Turn on Require Landlock for the strongest protection. OpenShell enforces filesystem rules with Linux Landlock. When it's off, a sandbox on a kernel without Landlock support runs with no filesystem restrictions.

Destinations sandboxed agents can connect to. Each rule has:

A rule applies only to the programs listed in Binaries. Other programs in the sandbox can't use it.

Each entry must be an absolute path inside the sandbox. Where a program lives depends on the sandbox image and how the agent was installed, so check the path in your image. The paths in this article's examples are illustrative.

Model provider APIs sandboxed agents can call, such as api.anthropic.com. Each endpoint has:

Model access that OpenShell providers would normally add is turned off while this policy is applied. List every model endpoint your agents need.

The user and group that sandboxed agents should run as.

OpenShell 0.1 doesn't enforce this in a centrally applied policy. Sandboxes keep running as their image's user, and every sandbox is reported as process not applied. Swif still sends the setting, so it takes effect automatically if a later OpenShell version supports it.

The agent can report each sandbox's network decisions to the Agent Flight Recorder. This shows, for each agent session, which program tried to reach which host, whether it was blocked, and where decisions were lost, next to the session's other guardrail events.

Only the program, host, and port are reported. URLs, headers, and content are never reported.

The agent reads each sandbox's log on the interval. If a sandbox makes a burst of connections between reads, some decisions can be lost. The Flight Recorder shows these as gaps.

Rule names can't start with _provider_ or swif_inference_. OpenShell and Swif reserve these prefixes, and Swif rejects names that use them.

The agent can work in its working directory, use Git with GitHub, and call Claude. Everything else is blocked, and blocked connections are reported to the Flight Recorder.

The agent can read from the internal docs API with curl, but it can't send POST, PUT, PATCH, or DELETE requests to it.

Filesystem changes apply right away, by restarting sandboxes, and every network decision is recorded. Use this only where users have been told that sandboxes may restart and running agent sessions may end.

Turning off Enabled, or unassigning the policy, removes only the policy Swif set. Policies that someone else set on the device are left alone.

Names can't start with _provider_ or swif_inference_, which are reserved. Names must also be lowercase letters, digits, or underscores: up to 64 characters for Network Access rules, and up to 48 for Model Endpoints.

The host isn't listed. When the policy is enabled, everything not in Network Access or Model Endpoints is blocked, including model access that OpenShell providers would otherwise add. Add the missing host, and check that Binaries includes the program making the connection.

Filesystem rules apply only when a sandbox starts. Restart the sandbox, or set When A Sandbox Runs Old Filesystem Settings to restart.

Require Landlock is on, and the kernel can't enforce the filesystem rules. Update the kernel to one that supports Landlock, or turn off Require Landlock.

This is expected. OpenShell 0.1 doesn't apply Run As User or Run As Group from a centrally applied policy.

Swif reports this as drift. With When The Policy Is Removed Or Replaced set to reapply, Swif applies its policy again.

A sandbox made more connections between reads than the agent could capture. Lower Network Decision Interval (Seconds).

This is expected. OpenShell runs on Windows only inside WSL 2, which this policy doesn't cover.

Swif

NVIDIA