Zero-Trust OpenClaw Architecture Adds Pre-Execution Authorization and Post-Execution Verification
An open-source security architecture for OpenClaw addresses the problem of agents having ambient OS permissions with no reliable verification of their actions. The solution implements two hard checkpoints in the execution loop.
Pre-Execution Gate
A local Rust daemon called predicate-authorityd intercepts every tool call before execution and checks it against a declarative policy. This provides sub-millisecond authorization overhead with p99 <25ms. The system is fail-closed: if the sidecar is down, everything is denied. For example, if an agent tries to write to /etc/passwd, it's hard blocked and the host OS is never touched.
Post-Execution Verification
Instead of asking an LLM "did it work?" after browser actions, the system runs deterministic assertions like:
url_contains("news.ycombinator.com")→ PASSelement_exists("titleline")→ PASSdom_contains("Show")→ PASS
The .eventually() pattern handles SPA hydration without brittle sleep() calls.
Tracing and Token Savings
Every step—authorization decisions, DOM snapshots, verification results—gets pushed to a trace (local or cloud). You can replay the agent's exact state step-by-step in a web portal, useful for debugging failed assertions or auditing what the agent actually saw (screenshots included).
The predicate-snapshot skill compresses the DOM to only actionable elements, achieving 90-99% token savings. In a demo extracting Hacker News posts, it used ~1200 tokens per step instead of 50k+ for raw HTML.
Use Cases and Future Development
This architecture is production-ready for tasks like price monitoring on e-commerce sites (Amazon, eBay), competitor tracking, lead generation from directories, or any web scraping where you need guarantees the agent actually extracted the right data.
The pre-execution gate already works for any agent (it's just HTTP calls to the sidecar). Future development includes extending post-execution verification to non-web agents—file system state assertions, API response validation, database checks—using the same deterministic approach without LLM-as-judge.
Repositories
- OpenClaw security plugin: https://github.com/PredicateSystems/predicate-claw (with GIF demo)
- OpenClaw Snapshot skill: https://github.com/PredicateSystems/openclaw-predicate-skill
📖 Read the full source: r/clawdbot
👀 See Also
Clawndom: A Security Hook for Claude Code to Block Vulnerable npm Packages
A developer built Clawndom, an open-source hook for Claude Code that checks npm packages against the OSV.dev vulnerability database before installation, blocking known vulnerable packages while maintaining agent autonomy.
Open-Source Attack Surface Management Cheat Sheet Released
A developer has open-sourced an Attack Surface Management cheat sheet that covers practical workflows, tools, and references. The project includes sections on asset discovery, infrastructure tracking, reconnaissance tooling, automation workflows, and learning resources.
Using FastAPI Guard to secure OpenClaw instances against attacks
FastAPI Guard provides middleware that adds 17 security checks including IP filtering, geoblocking, rate limiting, and penetration detection. The tool blocks attacks like those documented in OpenClaw security audits showing 512 vulnerabilities and 40,000+ exposed instances.
AI Agent Security: Token Budget Determines Data Exfiltration Risk
A developer tested AI agents connected to Gmail: frontier models caught phishing, mid-tier was unstable, cheap models silently forwarded malicious emails. Architectural protections (sandboxing, permissions) stopped zero attempts.