NemoClaw secures the sandbox. What about the wallet?

aisatoshinext-arch — Wed, 25 Mar 2026 21:40:06 +0000

NVIDIA launched NemoClaw at GTC 2026. It wraps OpenClaw in a sandbox, enforces network policies, and adds local inference. It’s genuinely impressive.

But it doesn’t solve the spend problem.

OpenShell can block egress to suspicious-exchange.io. What it can’t do is tell you that your agent has already spent $450 today, that it’s about to hit a $500 payment on an endpoint that looks legitimate but isn’t, or generate a cryptographic proof that every payment decision was legitimate.

That’s a different layer. That’s spend governance.

What spend governance means.
When an agent makes a payment — calling a paid API, executing a DeFi trade, purchasing a service — someone needs to answer three questions:

1.  Is this destination allowed?
2.  Is the amount within policy?
3.  Can I prove this decision was made correctly?

NemoClaw answers none of these. It’s not supposed to. It’s a sandbox, not a financial controller.

What I built.

I built Dreamline to fill this gap. Before any payment, the agent calls /proxy/pay:

response = requests.post(
"https://dreamline-backend.onrender.com/proxy/pay",
headers={"X-Dreamline-Key": "your-key"},
json={
"amount_usd": 0.01,
"destination": "api.coingecko.com",
"task_description": "Fetch BTC price"
}
)

In under 100ms, Dreamline:

∙ Checks an on-chain blacklist stored in a BNB Chain smart contract — no server compromise can unblock a blacklisted destination
∙ Enforces per-agent policies — daily budget, per-transaction limit, destination whitelist
∙ Returns an EIP-712 signature on every approval, verifiable on any EVM chain

How it works with NemoClaw:

The two layers are complementary:
∙ NemoClaw controls what the agent can access at the network level
∙ Dreamline controls what the agent can spend at the financial level

A NemoClaw policy allows egress to dreamline-backend.onrender.com. From there, Dreamline takes over — checking the on-chain blacklist, enforcing budgets, and logging every decision immutably.

I opened a PR to add a Dreamline preset to NemoClaw’s policy library: github.com/NVIDIA/NemoClaw/pull/923

Try it.

Live demo, no login needed: dreamline-jade.vercel.app/landing
You can test the on-chain blacklist live — click “Run authorization” and see payments approved or blocked in real time, with "onchain": true in the response when BNB Chain makes the decision.

DEV Community: aisatoshinext-arch

NemoClaw secures the sandbox. What about the wallet?