At GTC on March 16, Nvidia’s Jensen Huang told the room that “Every single company in the world today has to have an OpenClaw strategy.” He’s right. An OpenClaw strategy for business turns out to be one page long, it doesn’t start with picking an agent, and nobody should install anything until it’s written. The page lists what the agent may read, change, send and spend.
Key points
- What does an OpenClaw strategy for business need first? A list of what the agent is allowed to do.
- What went wrong before anyone had a strategy? Two dated facts, both from before the keynote. On January 28, Cisco’s AI security team tested a third-party OpenClaw add-on and reported nine findings, two critical, including silent data exfiltration and an instruction to bypass the assistant’s safety guidelines.
- Is NemoClaw the answer? No, not yet, and not on its own. Huang announced NemoClaw, an open source stack that installs a sandbox runtime called OpenShell with policy, network and privacy guardrails.
- What goes on the permissions card? One page, five lines, signed by whoever owns the risk.
What does an OpenClaw strategy for business need first?
A written list of what the agent is allowed to do: which accounts it can read, which folders it can change, what it can send on your behalf and what it can spend. An agent that runs on its own schedule with your credentials is closer to a new hire with a master key than to ordinary software.
A list of what the agent is allowed to do. That means which accounts it can read, which folders it can change, what it can send on your behalf and what it can spend. An agent that runs on its own schedule with your credentials is closer to a new hire with a master key than to a piece of software.
Most firms skip this because the demo is exciting and the paperwork isn’t. The price arrives the first time something goes wrong and nobody can say what the agent was permitted to do. A permissions card fixes that in an afternoon.
What went wrong before anyone had a strategy?
Two dated facts, both from before the keynote. On January 28, Cisco’s AI security team tested a third-party OpenClaw add-on and reported nine findings, two critical, including silent data exfiltration and an instruction to bypass the assistant’s safety guidelines. Cisco’s own summary was that security for OpenClaw is an option and not built in.
On February 1, the US National Vulnerability Database published CVE-2026-25253. Versions before 2026.1.29 connect to an address taken from a link without asking. The listed severity score, supplied by the CVE’s assigning authority, is 8.8 out of 10. The flaw sits in how the software handles a link, so it needs no unusual skill to trigger, and that’s why the patch date matters to anyone who installed early.
We aren’t claiming the current version is unsafe. The record is a reason to start small.
There’s a Monday-morning job in that history as well. Ask around the office whether anyone installed OpenClaw before February, and if they did, check the version number against 2026.1.29 or later. It takes minutes. People who tried the tool on a weekend rarely tell anyone, so ask in a way that makes a yes easy, and don’t treat it as a confession.
Is NemoClaw the answer?
No, not yet, and not on its own. Huang announced NemoClaw, an open source stack that installs a sandbox runtime called OpenShell with policy, network and privacy guardrails. Nvidia says that makes agents more trustworthy, and its press release offers no benchmarks or independent verification.
It also says many features are at various stages and will be offered when and if available. No general availability date is given.
A guardrail helps only if someone has set the rules, and nobody has set yours. Buying now means buying a lock before you’ve decided which doors matter. Decide the doors, then check whether the lock, from any vendor, can enforce your list. If a tool can’t express a rule like “read the shared mailbox, draft replies, never send,” it isn’t ready for your office.
What goes on the permissions card?
One page and five lines, signed by whoever owns the risk: what the agent reads, what it writes, what it may send or spend with approval, where it runs, and who can switch it off. Keep it short enough that people read it before they approve anything and simple enough to hand to a new hire.
- Reads. Name the accounts and folders. Everything else is off limits.
- Writes. Name what it may change. Start with nothing, then drafts only.
- Sends and spends. Nothing goes out and no money moves without a person approving it. Set a spending cap with the model provider as well.
- Where it runs. A separate machine or account, not your own laptop with your own passwords.
- Off switch. One named person who can shut it down, and the steps to do it.
Take a 40-person firm whose office administrator wants an agent on the shared mailbox. In week one, it reads a copy of the mailbox and drafts replies for a person to send. In week two, someone compares its log against what was actually sent. Only then do you add one permission, and you write down which one.
Here’s how the filled card might read for that mailbox, as our illustration. Reads: the shared support inbox, nothing else. Writes: drafts folder only. Sends and spends: nothing, a person clicks send. Where it runs: a separate account with its own login, created for this job. Off switch: the operations lead, who knows where the account’s password is kept. That’s five lines and about ten minutes of thought. It also gives you a sentence to say to a customer or an insurer when they ask what your agent can reach.
Treat add-ons as untrusted code. The Cisco finding was about a third-party add-on, not the core product, which means the install you vetted last month can change when someone adds a skill from a repository. Put add-ons on the card as an extra line, with a rule that nothing gets added without the owner’s initials and a date.
Staff will try these tools before you approve them, which is the pattern in our Moltbot agent security checklist. Our piece on OpenAI’s consulting deals for AI agents makes the same point from the vendor side, that permissions are the hard part. If the agent will operate a desktop, read our test-first look at GPT-5.4 computer use before you trust a benchmark score, and our note on the workplace AI adoption gap explains why leaders often misjudge how much staff already use.
Who can skip the card?
Anyone running an agent that can’t reach their mail, files or money. Summarising public pages doesn’t need a sandbox, and a firm that treats a one-page card as a committee has missed the point. The card is for agents that touch your accounts.
If you’re unsure which side of that line an agent sits on, assume it touches them, because an agent that’s useful for office work usually needs a login, and a login you’ve handed over is one you now have to list.
The advice does age. OpenClaw moves weekly, so a card written today needs a review date on it. Nvidia’s guardrails may turn out to be excellent, and independent test results against real attacks would be enough to change how much weight we put on the lock rather than the list.
Write the card this week, date it, and put the next review in the calendar.
Frequently asked questions
What is an OpenClaw strategy for a small business?
It is a short, written plan for what an OpenClaw-style agent may read, change, send and spend, plus where it runs and who can shut it off. It matters more than which agent you choose.
What is NemoClaw?
An Nvidia software stack announced on March 16, 2026, that installs the OpenShell runtime and open models to add policy, network and privacy guardrails to OpenClaw agents. Nvidia hasn’t published independent verification of its claims.
Is OpenClaw safe for business use?
It has had a high-severity vulnerability reported and an add-on found sending data out silently. Run it on a separate machine, start read-only, treat add-ons as untrusted code and keep a person on every send.
We have not tested OpenClaw or NemoClaw. Archive entry dated March 17, 2026, written and fact-checked on October 8, 2026. Sources are linked on the claims they support.
