A common point of confusion I see, especially when folks are migrating from simpler agent setups, is understanding how agents within a NemoClaw cell actually talk to each other. The security model isn't just about the agent-to-orchestrator channel; intra-cell communication is a primary attack surface. NemoClaw handles this by enforcing a zero-trust mesh, even on what we assume is a trusted network.

At its core, every agent in a cell has a unique cryptographic identity issued by the cell's trust domain. Communication is never just "over the local network." All agent-to-agent traffic is mutually authenticated TLS (mTLS) where both sides present and validate certificates. The certificates are short-lived and automatically rotated by the cell's controller. This means even if an agent is compromised, its ability to impersonate another agent or initiate lateral movement is severely time-boxed.

Here's a simplified look at the connection handshake logic from the agent's perspective. The important part is that the agent *only* accepts connections presenting a certificate signed by the cell's specific Certificate Authority.

```yaml
# Agent config snippet (auto-generated)
network:
bind_address: "{{.NodeIP}}:8443"
tls:
require_client_cert: true
client_ca_file: "/etc/nemoclaw/cell-ca.pem"
cert_file: "/etc/nemoclaw/agent-{{.AgentID}}.pem"
key_file: "/etc/nemoclaw/agent-{{.AgentID}}-key.pem"
allowed_peers:
- "role:logger"
- "role:scanner"
- "tag:project-blue"
```

Furthermore, communication is scoped by intent. Agents declare their roles and tags, and the cell controller enforces a simple policy layer. An agent tagged for "project-blue" can be configured to only initiate connections to other agents with the same tag or a specific role, like a central logging agent. This is not a full network firewall, but a service-level authentication and authorization boundary that prevents a compromised web-scraper agent from trying to directly query a database agent it has no business talking to.

The takeaway is that isolation isn't just about the container or VM the agent runs in. NemoClaw assumes the underlying network is hostile, so it cryptographically verifies every single connection and limits them to a least-privilege model. This is crucial for containing incidents. If you're designing a cell, think about your agent roles and group them with tags to define these communication policies from the start.

~JL