Question 1

Can Rego policies grant access that YAML policies deny?

Accepted Answer

No. Rego policies operate within the boundary set by static YAML/Landlock/seccomp policies. If your YAML policy blocks all network access, no Rego policy can override that. Think of YAML as the outer fence and Rego as the inner gate. Rego can deny what YAML allows, but it cannot allow what YAML denies. This is a security design decision — the kernel-level enforcement cannot be overridden by a user-space policy engine.

Question 2

What is the performance impact of TLS termination?

Accepted Answer

NemoClaw's proxy terminates and re-encrypts every outbound TLS connection for L7 inspection. This adds latency — typically 2-10ms per request depending on payload size. For agents making hundreds of API calls per minute, the cumulative overhead is measurable but not usually a bottleneck. If latency is critical, consider using YAML-only policies (L3/L4) for high-frequency, low-sensitivity endpoints and reserving Rego (L7) inspection for sensitive endpoints where body inspection matters.

Question 3

How do I debug a Rego policy that denies requests unexpectedly?

Accepted Answer

Use OPA's built-in REPL to test your policy against specific input documents: opa eval -d policies/network/ -i test-input.json "data.nemoclaw.network.allow". This evaluates the policy with your test input and shows the decision. For production debugging, check NemoClaw's policy audit log: nemoclaw logs --component policy | grep DENY. Each denial includes the deny_reason message from your Rego rules.

Question 4

Can I use external data in Rego decisions?

Accepted Answer

Yes. OPA supports external data bundles. You can maintain a JSON file with IP allowlists, user role mappings, or schedule definitions and load it as external data. NemoClaw's OPA integration supports bundle updates via the nemoclaw policy data update command. This is how enterprise teams implement role-based access control — maintain a role mapping in external data and reference it in Rego rules.

Tag: OPA

Writing Custom Rego Policies for NemoClaw: Advanced Network Rules Beyond YAML