OpenClaw

Personal agent (self-hosted) · OpenClaw · 7/7 verified · Last checked 2026-10-16

Layered tool allow and deny policies, exec approvals on the host, and a Docker sandbox with no network by default. Sandboxing itself is off until you turn it on, and without settings or a sandbox, sessions get full access.

Overall: B (2.29 avg, 7/7 controls verified)

Lock this down first

Turn on agents.defaults.sandbox and run openclaw security audit before exposing the Gateway beyond loopback.

Scorecard

Criterion	Rating	Notes
Permission granularity	3/3	Tool profiles, groups and allow/deny layers per agent, provider and sandbox. Denied tools stay denied inside the sandbox.
Human approval gates	1/3	Exec approvals combine policy, allowlist and optional user approval, but exec.security defaults to full on gateway and node hosts, and exec.ask defaults to off.
Sandboxing	2/3	Off by default. When on, tool execution runs in Docker, Podman, SSH or OpenShell backends with a read-only root and dropped capabilities.
Secrets handling	2/3	SecretRefs keep supported credentials out of plaintext config, with external manager providers. Plaintext stays until you migrate.
Audit logs	3/3	A metadata-only audit ledger of agent runs and tool actions is on by default, kept 30 days, queryable with openclaw audit.
Kill switch / interrupt	3/3	/stop aborts the current run and stops its Gateway or sandbox commands, including ones already running.
Network egress control	2/3	Off by default (needs the sandbox). With the sandbox on, containers default to network none.

Sources

Vendor? Request a correction. We review corrections within 7 days.