Network egress allowlist
Tools an agent requests are recorded, but Claw does not firewall outbound traffic. Treat the tool list as a record, not a boundary.
SECURITY
What we enforce,
and what we do not.
Security claims are easy to write and hard to check. This page separates the controls that run on our server from the ones that are still just plans, so you can decide with the real list.
ENFORCED TODAY
Checks that run
before the agent does.
Each of these is a server side gate. You can watch every one of them refuse a request inside your own workspace.
Spend cap per agent
Every agent carries a monthly credit ceiling. The check runs on the server before OpenClaw is called, so a capped agent cannot spend by accident or on purpose.
Workspace kill switch
One switch stops every agent in a workspace. While it is on, no request reaches the runtime, including work that was already queued.
Approval gate
Any agent can be set to hold its work until a person decides. Held requests wait in Approvals and never touch the runtime until someone approves them.
Audit log that records refusals
Blocked and held work is written to the log with its reason, next to the work that succeeded. Export it as CSV or JSON at any time.
Isolated client workspaces
Agents, rooms, credits, and audit trails belong to one workspace. Switching between clients issues a new session rather than changing what is displayed.
Credential handling
Passwords are stored as salted scrypt hashes. Session tokens are stored as SHA-256 hashes, so the database cannot be used to sign in even if it is copied.
NOT BUILT YET
The honest half
of the list.
These come up in most vendor reviews. None of them exist in Claw today. When one ships, it moves to the section above and this line disappears.
Per agent process isolation
Agents run through one OpenClaw runtime. Non-root execution, dropped capabilities, and a read-only root filesystem are planned and not built.
SSO and SAML
Sign in is email and password only. There is no identity provider connection and no SCIM.
Roles beyond owner and member
The column exists. Enforcement currently separates owners from everyone else and nothing finer.
Independent certification
Claw has no SOC 2, no ISO 27001, and no third party penetration test. Anyone telling you otherwise is guessing.
Service level agreement
There is no SLA and no service credit scheme yet. Uptime is not measured by a public status page, so no uptime figure is published.
CHECK IT YOURSELF
Do not take
our word for it.
The fastest way to test a control is to make it fail on purpose. This takes about a minute inside a free workspace.
1. Cap it to nothing
Open the fleet, set an agent spend cap to zero, then ask it for something. The request is refused before the runtime is touched.
2. Pull the switch
Turn on the workspace kill switch and try again from any room. Everything stops, not just the agent you were talking to.
3. Read the log
Open the audit log. Both refusals are there with their reason, and the export button hands you the same rows as CSV or JSON.