openclaw policy CLI Reference: Enterprise Conformance Checks

openclaw policy

The bundled Policy plugin supplies openclaw policy. It acts as an enterprise conformance layer over existing OpenClaw settings, not as a separate configuration system. Requirements are authored in policy.jsonc; OpenClaw treats the active workspace as evidence; drift is reported through doctor --lint. Policy neither enforces tool calls nor alters runtime behavior at request time, nor does it attest per-agent credential stores such as openclaw-agent.sqlite.

Policy examines configured channels, MCP servers, model providers, network SSRF posture, ingress/channel access, Gateway exposure and node command posture, authored message-routing probes, agent workspace access, sandbox posture, data-handling posture, secret provider/auth profile posture, and governed tool metadata (the ## Tools section of AGENTS.md). Deploy it when a workspace requires a durable, checkable assertion like "Telegram must not be enabled" or "governed tools must declare risk and owner metadata." If only local behavior is needed without attestation or drift detection, plain config suffices.

Separately, openclaw agent exec applies an isolated implicit policy config per run: the agent sandbox is off, Gateway-host execution is fully allowed, and filesystem tools are limited to --cwd.

Quick start

openclaw plugins enable policy

The plugin remains active even when policy.jsonc is absent, allowing doctor to report the missing artifact rather than silently skipping checks.

Hand-author policy.jsonc; it is never generated from current settings. Each top-level section acts as a rule namespace: a check runs only when a concrete rule exists under it (unsupported sections or keys fail as policy/policy-jsonc-invalid instead of being silently ignored). Minimal example covering every supported section:

{
  "channels": {
    "denyRules": [
      {
        "id": "no-telegram",
        "when": { "provider": "telegram" },
        "reason": "Telegram is not approved for this workspace.",
      },
    ],
  },
  "mcp": {
    "servers": {
      "allow": ["docs"],
      "deny": ["untrusted"],
    },
  },
  "models": {
    "providers": {
      "allow": ["openai", "anthropic"],
      "deny": ["openrouter"],
    },
  },
  "network": {
    "privateNetwork": {
      "allow": false,
    },
  },
  "routing": {
    "requireBindings": true,
    "requireConfiguredChannels": true,
    "probes": [
      {
        "id": "family-dm",
        "route": {
          "channel": "imessage",
          "peer": { "kind": "direct", "id": "+15555550123" },
        },
        "expect": {
          "agentId": "family",
          "matchedBy": ["binding.peer"],
        },
      },
    ],
  },
  "ingress": {
    "session": {
      "requireDmScope": "per-channel-peer",
    },
    "channels": {
      "allowDmPolicies": ["pairing", "allowlist", "disabled"],
      "denyOpenGroups": true,
      "requireMentionInGroups": true,
    },
  },
  "gateway": {
    "exposure": {
      "allowNonLoopbackBind": false,
      "allowTailscaleFunnel": false,
    },
    "auth": {
      "requireAuth": true,
      "requireExplicitRateLimit": true,
    },
    "controlUi": {
      "allowInsecure": false,
    },
    "remote": {
      "allow": false,
    },
    "http": {
      "denyEndpoints": ["chatCompletions", "responses"],
      "requireUrlAllowlists": true,
    },
    "nodes": {
      "denyCommands": ["system.run"],
    },
  },
  "agents": {
    "workspace": {
      "allowedAccess": ["none", "ro"],
      "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
    },
  },
  "dataHandling": {
    "sensitiveLogging": {
      "requireRedaction": true,
    },
    "telemetry": {
      "denyContentCapture": true,
    },
    "retention": {
      "requireSessionMaintenance": true,
    },
    "memory": {
      "denySessionTranscriptIndexing": true,
    },
  },
  "secrets": {
    "requireManagedProviders": true,
    "denySources": ["exec"],
    "allowInsecureProviders": false,
  },
  "auth": {
    "profiles": {
      "requireMetadata": ["provider", "mode"],
      "allowModes": ["api_key", "token"],
    },
  },
  "execApprovals": {
    "requireFile": true,
    "defaults": { "allowSecurity": ["deny"] },
    "agents": {
      "allowSecurity": ["deny", "allowlist"],
      "allowAutoAllowSkills": false,
      "allowlist": { "expected": ["deploy", "status"] },
    },
  },
  "tools": {
    "requireMetadata": ["risk", "sensitivity", "owner"],
    "profiles": {
      "allow": ["messaging", "minimal"],
    },
    "fs": {
      "requireWorkspaceOnly": true,
    },
    "exec": {
      "allowSecurity": ["deny", "allowlist"],
      "requireAsk": ["always"],
      "allowHosts": ["sandbox"],
    },
    "elevated": {
      "allow": false,
    },
    "denyTools": ["group:runtime", "group:fs"],
  },
}

Cross-cutting notes not obvious from the rule tables below:

• If gateway.bind is omitted while denying non-loopback binds, you accept the runtime default; set gateway.bind: "loopback" for strict conformance.
• For a read-only agent, set sandbox mode to all or non-main on the applicable defaults/agent and workspaceAccess to none or ro. Missing or off sandbox mode does not satisfy a read-only policy.
• agents.workspace.denyTools accepts exec, process, write, edit, apply_patch. The config tool-deny groups group:fs (file mutation) and group:runtime (shell/process) satisfy the equivalent posture.
• Exec-approvals checks read the live SQLite approvals document only when an execApprovals rule is present; a missing or invalid artifact is unobservable evidence, not a synthetic pass.
• Secret and auth-profile evidence records provider/source posture and SecretRef metadata only, never raw values. Policy does not read or attest per-agent credential stores such as openclaw-agent.sqlite.
• Data-handling evidence is config-level posture (telemetry capture toggle, session maintenance mode, transcript-indexing setting) plus the always-on log redaction invariant. It does not inspect logs, telemetry exports, transcripts, or memory files, and a clean result does not prove that no personal data or secrets exist in them.
• Routing probes reuse OpenClaw's runtime binding resolver. Routing evidence records only the probe id, resolved agent, match kind, and redacted binding metadata. It never records peer, account, guild, team, or role identifiers. Adding a routing section intentionally changes the policy and attestation hashes; policies without routing keep their existing evidence shape.

Policy rule reference

Every rule below is optional; a check runs only when the rule is present. The observed state is existing OpenClaw config or workspace metadata.

Scoped overlays

Use scopes.<scopeName> when specific agents or channels need stricter policy than the top-level baseline. The scope name is just a label; matching uses the selector inside the scope. Overlays are additive: the global rule still runs, and the scoped rule can add its own finding against the same evidence.

If an agentIds entry is not present in agents.entries.*, OpenClaw evaluates the scoped rule against inherited global/default posture for that runtime agent id instead of skipping it.

{
  "tools": {
    "exec": {
      "allowHosts": ["sandbox", "node"],
    },
  },
  "sandbox": {
    "requireMode": ["all", "non-main"],
  },
  "scopes": {
    "release-workspace": {
      "agentIds": ["release-agent", "review-agent"],
      "agents": {
        "workspace": {
          "allowedAccess": ["none", "ro"],
        },
      },
    },
    "release-lockdown": {
      "agentIds": ["release-agent"],
      "tools": {
        "exec": {
          "allowHosts": ["sandbox"],
          "allowSecurity": ["deny", "allowlist"],
          "requireAsk": ["always"],
        },
        "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
      },
      "sandbox": {
        "requireMode": ["all"],
        "allowBackends": ["docker"],
      },
      "dataHandling": {
        "memory": {
          "denySessionTranscriptIndexing": true,
        },
      },
    },
    "shell-sandbox": {
      "agentIds": ["shell-agent"],
      "sandbox": {
        "allowBackends": ["openshell"],
        "containers": {
          "requireReadOnlyMounts": false,
        },
      },
    },
    "telegram-ingress": {
      "channelIds": ["telegram"],
      "ingress": {
        "channels": {
          "allowDmPolicies": ["pairing"],
          "denyOpenGroups": true,
          "requireMentionInGroups": true,
        },
      },
    },
  },
}

The same agent can appear in multiple scopes if each scope governs a different field, as above. A repeated scoped field for the same agent must be equally or more restrictive; a weaker duplicate claim is rejected (allow-lists are subsets, deny-lists are supersets, required booleans are fixed).

Container posture rules (sandbox.containers.*) are checked only against evidence the matched agent's sandbox backend can expose. The Docker and Podman backends expose the same sandbox.docker.* container posture settings. If a backend cannot observe a rule you enabled for it, policy reports policy/sandbox-container-posture-unobservable instead of passing; scope container rules to the agent groups that use a backend which can expose them.

Backend authorization uses the configured identity. backend: "docker" requires allowBackends: ["docker"], while backend: "podman" requires allowBackends: ["podman"].

Top-level ingress.session.requireDmScope stays global; session.dmScope is not channel-attributable evidence, so it cannot be scoped by channelIds.

Every scope present in policy.jsonc must be valid and enforceable.

Channels

MCP servers

Model providers

Network

Message routing

Probe ids must not repeat. A route accommodates channel, optional accountId, peer, parentPeer, guildId, teamId, and memberRoleIds. Peer kinds are direct, group, and channel. matchedBy can hold one or more runtime match kinds, such as binding.peer, binding.account, binding.channel, or default.

Routing checks serve as conformance checks only. They leave startup, message delivery, binding precedence, and fallback behavior untouched. Findings call for operator review, since a binding changed automatically could redirect private messages.

Ingress and channel access

Gateway

gateway.nodes.denyCommands functions as an exact, case-sensitive policy deny-superset rule. Deploy it when policy must demonstrate that privileged node commands are explicitly denied via OpenClaw config. A deployment that deliberately permits a privileged node command should revise policy.jsonc after review rather than depending on gateway.nodes.commands.allow alone.

Agent workspace

Sandbox posture

Policy treats missing sandbox.mode as its implicit default off, so sandbox.requireMode reports a fresh or unconfigured sandbox as outside an allowlist such as ["all"].

Data Handling

Secrets

Exec approvals

Exec-approvals checks read the runtime exec_approvals_config singleton row in ~/.openclaw/state/openclaw.sqlite by default, or the same database under $OPENCLAW_STATE_DIR/state when OPENCLAW_STATE_DIR is set. Findings keep the stable oc://exec-approvals.json/... URI scheme; it now denotes paths within the authoritative JSON document stored in that row. Posture rules under execApprovals.defaults.* or execApprovals.agents.* require readable artifact evidence; a missing or invalid artifact reports as unobservable evidence rather than a best-effort pass. Once readable, omitted fields inherit runtime defaults: missing defaults.security is full, and missing agent security inherits that default. Evidence includes defaults, agents.*, agents.*.allowlist[].pattern, optional argPattern, effective autoAllowSkills posture, and entry source, never socket path/token, commandText, lastUsedCommand, resolved paths, or timestamps.

Example: require the approvals artifact, deny permissive defaults, and allow only reviewed exec approval posture for selected agents.

{
  "execApprovals": {
    "requireFile": true,
    "defaults": {
      // Security modes: "deny", "allowlist", or "full".
      // This default permits only the locked-down deny posture.
      "allowSecurity": ["deny"],
    },
  },
  "scopes": {
    "restricted-shell": {
      "agentIds": ["family-agent", "groups-agent"],
      "execApprovals": {
        "agents": {
          // Selected agents may use reviewed allowlist posture, but not "full".
          "allowSecurity": ["allowlist"],
          // false means skill CLIs must appear in the reviewed allowlist instead of
          // being implicitly approved by autoAllowSkills.
          "allowAutoAllowSkills": false,
          "allowlist": {
            "expected": [
              // Simple entry: exact reviewed executable pattern with no argPattern.
              "travel-hub",
              // Constrained entry: pattern plus reviewed argument regex.
              { "pattern": "calendar-cli", "argPattern": "^sync\\b" },
              "/bin/date",
            ],
          },
        },
      },
    },
  },
}

Auth profiles

Tool metadata

Tool posture

Run checks

Execute policy-only checks while authoring:

openclaw policy check
openclaw policy check --agent ops
openclaw policy check --json
openclaw policy check --severity-min error

With policy check, only the policy check set runs, producing evidence, findings, and attestation hashes. When the Policy plugin is enabled, those findings surface in openclaw doctor --lint as well. For a multi-agent fleet with explicit ownership, supply --agent <id> so the command pulls governed declarations and policy.jsonc from that agent's workspace. Without the flag, a sole-agent or retained legacy-owner setup still resolves; OpenClaw never picks an arbitrary first agent.

Compare an operator policy file to an authored baseline:

openclaw policy compare --baseline official.policy.jsonc
openclaw policy compare --baseline official.policy.jsonc --agent ops
openclaw policy compare --baseline official.policy.jsonc --policy policy.jsonc --json

policy compare validates policy-file syntax against itself; runtime state, evidence, credentials, and secrets are not inspected. The same rule metadata governing scoped overlays applies here: allowlists must remain identical or tighter, denylists identical or wider, required booleans unchanged, ordered strings only shifting toward the stricter end of the configured sequence, and exact lists matching exactly. The baseline may be an organization-authored policy; the checked policy can introduce stricter values or additional rules. A top-level checked rule can fulfill a scoped baseline rule when it is equally or more restrictive. Scope names across files need not align; comparison keys on selector (agentIds/channelIds) and field. For routing probes, every baseline probe id must stay attached to the same route and expected agent. A checked policy may add probes or tighten matchedBy, yet removing a probe, altering its route or agent, or broadening its accepted match kinds counts as weaker.

When the checked policy path originates from the plugin configuration and is relative, --agent <id> picks the workspace for resolution. Absolute policy paths function independently of an agent workspace.

Clean compare (--json):

{
  "ok": true,
  "baselinePath": "official.policy.jsonc",
  "policyPath": "policy.jsonc",
  "rulesChecked": 3,
  "findings": []
}

Clean policy check --json output provides stable hashes that an operator or supervisor can note down:

{
  "ok": true,
  "attestation": {
    "policy": {
      "path": "policy.jsonc",
      "hash": "sha256:..."
    },
    "workspace": {
      "scope": "policy",
      "hash": "sha256:..."
    },
    "findingsHash": "sha256:...",
    "attestationHash": "sha256:..."
  },
  "checksRun": 5,
  "checksSkipped": 0,
  "findings": []
}

Configure policy

Policy configuration sits under plugins.entries.policy.config.

{
  "plugins": {
    "entries": {
      "policy": {
        "enabled": true,
        "config": {
          "enabled": true,
          "path": "policy.jsonc",
          "workspaceRepairs": false,
          "expectedHash": "sha256:...",
          "expectedAttestationHash": "sha256:...",
        },
      },
    },
  },
}

Assign plugins.entries.policy.config.enabled the value false to turn off policy checks for a workspace while keeping the plugin installed.

Accept policy state

Example JSON output:

{
  "ok": true,
  "attestation": {
    "checkedAt": "2026-05-10T20:00:00.000Z",
    "policy": {
      "path": "policy.jsonc",
      "hash": "sha256:..."
    },
    "workspace": {
      "scope": "policy",
      "hash": "sha256:..."
    },
    "findingsHash": "sha256:...",
    "attestationHash": "sha256:..."
  },
  "evidence": {
    "channels": [
      {
        "id": "telegram",
        "provider": "telegram",
        "source": "oc://openclaw.config/channels/telegram",
        "enabled": false
      }
    ],
    "mcpServers": [
      {
        "id": "docs",
        "transport": "stdio",
        "source": "oc://openclaw.config/mcp/servers/docs",
        "command": "npx"
      }
    ],
    "modelProviders": [
      {
        "id": "openai",
        "source": "oc://openclaw.config/models/providers/openai"
      }
    ],
    "modelRefs": [
      {
        "ref": "openai/gpt-5.6-sol",
        "provider": "openai",
        "model": "gpt-5.6-sol",
        "source": "oc://openclaw.config/agents/defaults/model"
      }
    ],
    "network": [
      {
        "id": "browser-private-network",
        "source": "oc://openclaw.config/browser/ssrfPolicy/dangerouslyAllowPrivateNetwork",
        "value": false
      }
    ],
    "gatewayExposure": [
      {
        "id": "gateway-bind",
        "kind": "bind",
        "source": "oc://openclaw.config/gateway/bind",
        "value": "loopback",
        "nonLoopback": false,
        "explicit": true
      }
    ],
    "agentWorkspace": [
      {
        "id": "agents-defaults-workspace-access",
        "kind": "workspaceAccess",
        "source": "oc://openclaw.config/agents/defaults/sandbox/workspaceAccess",
        "scope": "defaults",
        "value": "ro",
        "sandboxMode": "all",
        "sandboxModeSource": "oc://openclaw.config/agents/defaults/sandbox/mode",
        "sandboxEnabled": true,
        "explicit": true
      },
      {
        "id": "agents-defaults-tool-exec",
        "kind": "toolDeny",
        "source": "oc://openclaw.config/tools/deny",
        "scope": "defaults",
        "tool": "exec",
        "denied": true,
        "explicit": true
      }
    ],
    "secrets": [
      {
        "id": "vault",
        "kind": "provider",
        "source": "oc://openclaw.config/secrets/providers/vault",
        "providerSource": "env"
      },
      {
        "id": "oc://openclaw.config/models/providers/openai/apiKey",
        "kind": "input",
        "source": "oc://openclaw.config/models/providers/openai/apiKey",
        "provenance": "secretRef",
        "refSource": "env",
        "refProvider": "vault"
      }
    ],
    "authProfiles": [
      {
        "id": "github",
        "source": "oc://openclaw.config/auth/profiles/github",
        "validMetadata": true,
        "provider": "github",
        "mode": "token"
      }
    ],
    "tools": [
      {
        "id": "deploy",
        "source": "oc://AGENTS.md/tools/deploy",
        "line": 12,
        "risk": "critical",
        "sensitivity": "restricted",
        "capabilities": ["IRREVERSIBLE_EXTERNAL"]
      }
    ]
  },
  "checksRun": 30,
  "checksSkipped": 0,
  "findings": []
}

attestation.policy.hash points to the authored rule artifact. evidence captures the OpenClaw state observed during checks, and workspace.hash references that evidence payload. findingsHash identifies the exact finding set. checkedAt logs the check timestamp. attestationHash identifies the stable claim (policy hash, evidence hash, findings hash, and clean/dirty status) and intentionally omits checkedAt, so identical policy state always yields the same attestation hash. These four values together form the audit tuple for a single policy check.

When a gateway or supervisor uses policy to block, approve, or annotate a runtime action, it should log the attestation hash from the most recent clean check. checkedAt remains in JSON output for audit logs but falls outside the stable hash.

Lifecycle for accepting policy state:

1. Author or review policy.jsonc.
2. Execute openclaw policy check --json.
3. If clean, save attestation.policy.hash as expectedHash.
4. Save attestation.attestationHash as expectedAttestationHash.
5. Re-run openclaw doctor --lint in CI or release gates.

If policy rules change deliberately, refresh both accepted hashes from a clean check. If only workspace settings shift (policy unchanged), typically just expectedAttestationHash updates.

Enabling or upgrading agents.workspace rules injects agentWorkspace evidence into the workspace hash and attestation hash; review the new evidence and refresh accepted attestation hashes after enabling. Enabling or upgrading tool posture rules adds toolPosture evidence in the same manner.

openclaw policy watch re-executes the check and reports when current evidence no longer aligns with expectedAttestationHash:

openclaw policy watch --json
openclaw policy watch --agent ops --json

Use --once in CI or scripts needing a single drift evaluation. Without --once, it polls every two seconds by default; use --interval-ms to adjust the interval.

Findings

A finding may carry two parts: target for the workspace object observed to deviate, and requirement for the authored rule that triggered the finding. Currently both are oc:// address strings, though the field names indicate policy role rather than address format.

Example findings:

{
  "checkId": "policy/channels-denied-provider",
  "severity": "error",
  "message": "Channel 'telegram' uses denied provider 'telegram'.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/channels/telegram",
  "target": "oc://openclaw.config/channels/telegram",
  "requirement": "oc://policy.jsonc/channels/denyRules/#0",
  "fixHint": "Telegram is not approved for this workspace."
}

{
  "checkId": "policy/tools-missing-risk-level",
  "severity": "error",
  "message": "AGENTS.md tool 'deploy' has no explicit risk classification.",
  "source": "policy",
  "path": "AGENTS.md",
  "line": 12,
  "ocPath": "oc://AGENTS.md/tools/deploy",
  "target": "oc://AGENTS.md/tools/deploy",
  "requirement": "oc://policy.jsonc/tools/requireMetadata"
}

{
  "checkId": "policy/mcp-unapproved-server",
  "severity": "error",
  "message": "MCP server 'remote' is not in the policy allowlist.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/mcp/servers/remote",
  "target": "oc://openclaw.config/mcp/servers/remote",
  "requirement": "oc://policy.jsonc/mcp/servers/allow"
}

{
  "checkId": "policy/models-unapproved-provider",
  "severity": "error",
  "message": "Model ref 'anthropic/claude-sonnet-4.7' uses unapproved provider 'anthropic'.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/agents/defaults/model/fallbacks/#0",
  "target": "oc://openclaw.config/agents/defaults/model/fallbacks/#0",
  "requirement": "oc://policy.jsonc/models/providers/allow"
}

{
  "checkId": "policy/network-private-access-enabled",
  "severity": "error",
  "message": "Network setting 'browser-private-network' allows private-network access.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/browser/ssrfPolicy/dangerouslyAllowPrivateNetwork",
  "target": "oc://openclaw.config/browser/ssrfPolicy/dangerouslyAllowPrivateNetwork",
  "requirement": "oc://policy.jsonc/network/privateNetwork/allow"
}

{
  "checkId": "policy/gateway-non-loopback-bind",
  "severity": "error",
  "message": "Gateway bind setting 'gateway-bind' permits non-loopback exposure.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/gateway/bind",
  "target": "oc://openclaw.config/gateway/bind",
  "requirement": "oc://policy.jsonc/gateway/exposure/allowNonLoopbackBind"
}

{
  "checkId": "policy/gateway-node-command-denied",
  "severity": "error",
  "message": "Gateway node command 'system.run' is denied by policy but not denied by OpenClaw config.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/gateway/nodes/commands/deny",
  "target": "oc://openclaw.config/gateway/nodes/commands/deny",
  "requirement": "oc://policy.jsonc/gateway/nodes/denyCommands",
  "fixHint": "Add 'system.run' to gateway.nodes.commands.deny or update policy after review."
}

{
  "checkId": "policy/agents-workspace-access-denied",
  "severity": "error",
  "message": "agents.defaults sandbox workspaceAccess 'rw' is not allowed by policy.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/agents/defaults/sandbox/workspaceAccess",
  "target": "oc://openclaw.config/agents/defaults/sandbox/workspaceAccess",
  "requirement": "oc://policy.jsonc/agents/workspace/allowedAccess"
}

Repair

Access to doctor --lint and policy check is read-only.

When workspaceRepairs is not explicitly turned on, doctor --fix only touches policy-managed workspace settings; otherwise, checks report what they would fix and leave settings untouched.

In this release, repair can turn off channels that channels.denyRules denies and carry out the automatic narrowing repairs listed below. Turn on workspaceRepairs only after reviewing the policy file, since a valid rule can alter workspace config:

• apply tools.elevated.enabled=false when a global policy blocks elevated tools
• insert missing required-deny tool ids into tools.deny or agents.entries.*.tools.deny when policy requires those tools to be denied
• flip insecure gateway.controlUi.* toggles to false
• apply gateway.mode=local when policy blocks remote gateway mode
• change reported gateway.http.endpoints.*.enabled paths to false when policy blocks Gateway HTTP API endpoints
• change reported channel ingress groupPolicy paths to allowlist when policy blocks open group ingress
• change reported channel ingress requireMention paths to true when policy requires group mentions
• apply diagnostics.otel.captureContent=false, or diagnostics.otel.captureContent.enabled=false for object-form telemetry capture settings, when policy blocks telemetry content capture

Repairs scoped to elevated tools are detect-only. Scoped data-handling repairs are also skipped when the finding points to shared telemetry config, because altering the shared setting would impact more than the scoped policy target.

dataHandling.sensitiveLogging.requireRedaction offers neither check nor repair. OpenClaw always redacts sensitive logs, so nothing can flag it as off. The key remains a supported policy rule: openclaw policy checks its shape, openclaw policy compare still requires a candidate policy to be at least as strict as the baseline for it, and openclaw policy check logs the runtime invariant oc://openclaw.invariant/logging/redaction in the dataHandling evidence and attestation as proof the requirement is met.

Scoped required-deny repairs are skipped when the finding reports inherited root tools.deny, because adding the required tool to root config would impact more than the scoped policy target. Agent-local required-deny repairs can update the reported agents.entries.*.tools.deny path.

Scoped channel ingress repairs are skipped when the finding reports inherited channels.defaults.*, because changing the shared channel default would impact more than the scoped policy target. Gateway HTTP URL-fetch allowlist findings stay manual because automatic repair cannot pick the correct endpoint URL allowlist values.

Gateway bind and node-command findings always require review. When policy/gateway-non-loopback-bind or policy/gateway-node-command-denied can be resolved to a config path, doctor --fix surfaces the suggested gateway.bind or gateway.nodes.commands.deny adjustment as skipped preview guidance. No change is applied, and the finding stays unrepaired until an operator reviews and modifies config or policy.

{
  "plugins": {
    "entries": {
      "policy": {
        "config": {
          "workspaceRepairs": true,
        },
      },
    },
  },
}

Exit codes

Related

• Doctor lint mode
• Path CLI