Enforcing Hard Guardrails for OpenClaw AI Agents: Approval Gating and Concurrency Limits

A developer running an OpenClaw bot on a Mac mini with Ollama (GLM 5.2, fallback to Anthropic Sonnet 4.6 and Haiku) hit a classic problem: the bot repeatedly violates hard rules—like "never send emails without approval" and "max 5 concurrent calls"—even though it confirms understanding each time. The user's hypothesis is spot-on: this is rules-as-context, not rules-as-constraints. The model treats instructions as advisory, so no amount of prompting or memory reinforcement fixes it.

The standard fix is to move enforcement outside the model's reasoning loop. You can't rely on a statistical text predictor to enforce hard limits; you need deterministic checks in the orchestration layer.

Approval Gating for Tool Calls

To gate emails (or any dangerous action) behind approval, wrap the tool call in a human-in-the-loop pattern:

• When the model requests an email send, intercept the call before it executes.
• Present a confirmation prompt in Discord (e.g., buttons or a reaction).
• Only if the user approves, execute the actual API call.

# Pseudo-code in your OpenClaw tool handler
if tool == "send_email":
    message = f"Approve sending email to {to}?"
    if not await discord_approval(message):
        return "User rejected. Do not send."
    # proceed with email API call

This ensures the model physically cannot bypass the gate—no matter what it says.

Concurrency Limits at the Orchestration Level

For concurrency limits like "max 5", implement a semaphore or counter in the command dispatcher:

import asyncio
semaphore = asyncio.Semaphore(5)

async def handle_tool_call(tool, args):
    async with semaphore:
        # execute tool call

Any attempt over the limit waits or fails immediately, regardless of model intent.

Is This a GLM/Ollama-Specific Problem?

The user asks if this is specific to GLM or general to local models. Based on the r/openclaw discussion, this is a general LLM limitation—all models treat instructions as context, not constraints. Prompting alone can't enforce hard limits. The solution always requires infrastructure-level enforcement.

Recommendation

Stop re-stating rules in memory or skills. Instead, build explicit checks into your tool-calling layer. Treat the model as a suggestion engine, not a policy enforcer.