CordClaw is the Cordum Edge OpenClaw adapter: hook the gateway, inspect structured metadata, and enforce policy before high-risk actions execute.
Threat path → governed job
pre-dispatchOpenClaw action
cron:unknown → exec
echo cm0gLXJmIC8= | base64 -d | sh
CordClaw decision
The action is evaluated as structured metadata before it can execute, then recorded in the local audit trail. Agent Control Plane recording remains in progress.
after_tool_execution is audit-only in the current hook surface; result rewriting stays labeled roadmap until the modifying hook is available.
CordClaw is the open-source Cordum Edge adapter for OpenClaw, with pre-dispatch policy enforcement for supported high-risk actions. It hooks the OpenClaw gateway at four points (agent_start, prompt_build, tool_call, message_write), sends structured metadata to a localhost daemon, and returns one of five typed decisions: ALLOW, DENY, THROTTLE, REQUIRE_HUMAN, or CONSTRAIN. Every decision is logged with a reason for audit.
CordClaw is governance, not a sandbox or a prompt rule. Sandboxes (like NemoClaw) isolate actions while they execute and limit runtime blast radius; they complement pre-dispatch governance. Prompt rules (like SecureClaw) live inside the model context where injection bypasses them. CordClaw evaluates structured envelope data — provider, channel, action, canonicalized command — before the gateway lets the call cross the execution boundary, so destructive payloads hidden in base64 or shell substitution are decoded and tagged before policy runs.
Pick CordClaw when you need deterministic, declarative policy in front of OpenClaw agents. Install from GitHub for plugin-only mode with local audit. The connected Cordum path for centralized policy bundles, approval inboxes, and configured audit exports remains in progress; do not treat the local adapter as tenant-wide enforcement.
CordClaw hardening focuses on the places OpenClaw agents can cross from reasoning into action. Each class is labeled by source-backed implementation status.
A compromised session replays a scheduled agent turn with an unknown cron id, then tries to launch a privileged action as if it came from a trusted schedule.
before_agent_start
job.openclaw.agent_start
CordClaw checks the agent-start envelope before the turn begins, correlates cron origin, and denies drift before any downstream tool can run.
Source: attack-classes.md, plugin hook, mapper topic
An agent reads a config file and quotes an API key into the model prompt, where it could land in a provider request log.
before_prompt_build
job.openclaw.prompt_build
The prompt-build hook sends assembled prompt text to the daemon first; policy can redact deterministic secret patterns or fail closed before the provider call.
Source: prompt DLP docs and tests
A policy that means “Slack send is allowed” accidentally covers Slack delete or file upload because the channel provider was treated as one coarse capability.
before_message_write
job.openclaw.message_write
CordClaw carries provider, channel, action, and sanitized preview so policy can allow slack.send while denying slack.delete and slack.upload_file.
Source: channel-action matrix and current hardening branch
A destructive command is hidden inside base64, shell variables, command substitution, or a symlink so raw regex tagging sees harmless text.
before_tool_execution
job.openclaw.tool_call
The daemon canonicalizes command text immediately before risk tagging, exposing decoded destructive intent while preserving the original payload for audit.
Source: canonicalize.Normalize and attack-class docs
An allowed fetch returns a large or sensitive result that would flow back into the agent context unchecked after the tool has already run.
after_tool_execution / result gate
job.openclaw.result_gating
The policy topic and budget rule are staged, but the current after-tool hook is audit-only; result rewriting stays roadmap until the modifying OpenClaw hook lands.
Source: pack policy staged; modifying hook blocked
CordClaw stays on the OpenClaw side of the Edge boundary: the TypeScript plugin and localhost daemon work locally today; Cordum-connected Edge governance remains in progress.
Architecture
Autonomous AI Agents request tool calls, prompt builds, agent starts, message writes, or result handling.
In-process hooks extract structured metadata before the action crosses the execution boundary.
The localhost sidecar normalizes risk, checks cache, applies fail-closed behavior, and asks policy for a typed decision.
Planned connected mode will route actions as job.openclaw.* governance jobs through Cordum policy and approval paths.
Planned connected visibility will let security teams see decision, reason, and audit status in Cordum instead of reverse-engineering agent logs.
Visibility Story
The Cordum-connected path is designed to put OpenClaw activity in the same /govern/jobs surface used for other Cordum-controlled actions. Security teams can scan decisions by topic, agent, reason, and policy status instead of reading raw agent transcripts.
Because the Phase-2 job-submission backbone is still being finalized, this page labels the jobs view as a mockup and keeps result-gating marked roadmap until the modifying hook exists.
Product mockup
| Topic | Agent | Decision | Reason | Status |
|---|---|---|---|---|
| job.openclaw.tool_call | release-bot | DENY | destructive command | live |
| job.openclaw.prompt_build | researcher | CONSTRAIN | prompt_pii_redact | live |
| job.openclaw.agent_start | scheduler | DENY | cron-origin-policy-mismatch | live |
| job.openclaw.message_write | ops-agent | DENY | slack.upload_file exfil-risk | shipping |
| job.openclaw.result_gating | browser-agent | CONSTRAIN | max_output_bytes | roadmap |
Mockup only: it shows the intended Cordum visibility model for job.openclaw.* topics. Live/staged labels follow the current CordClaw source inspection.
Every checked action maps to a typed decision and reason before the gateway lets it proceed.
Low-risk action executes immediately.
job.openclaw.tool_call: npm test
Dangerous action is blocked before execution.
job.openclaw.agent_start: cron drift
Action is rate-limited to reduce blast radius.
bursting autonomous action
Execution pauses until a reviewer approves.
external channel write
Action proceeds only with policy limits applied.
prompt redaction or result cap
Rows are sourced from the CordClaw README comparison table and kept focused on verifiable product differences.
| Capability | CordClaw | NemoClaw | SecureClaw | Native OpenClaw |
|---|---|---|---|---|
| Enforcement type | Pre-dispatch, deterministic | Runtime sandbox | In-context rules | Tool allow/deny lists |
| Prompt injection resistance | Structured envelope | Kernel-level | No — in context | No — config-level |
| Policy language | Declarative YAML | YAML sandbox rules | Natural language | JSON config |
| Decision types | 5 decisions | 2 decisions | 2 decisions | 2 decisions |
| Human review | Native approval gates | No | No | Basic exec approvals |
| Audit trail | Decision-level | Partial | No | No |
| Dashboard | Cordum dashboard | No | CLI only | No |
| Hardware dependency | None | NVIDIA preferred | None | None |
| Fail mode | Graduated fail-closed | Deny | N/A | N/A |
| Open source | Apache 2.0 | Open source | Open source | MIT |
The examples below match CordClaw's documented decision model and avoid claims that are not in the current code or pack.
# exact channel-action control
- id: openclaw-channel_action_allow-slack-upload-deny
match:
topics: ["job.openclaw.message_write"]
label_allowlist:
channel_action:
- slack.upload_file
decision: deny
reason: channel_action_denied provider=slack action=upload_file exfil-risk
# prompt PII redaction
- id: openclaw-prompt_pii_redact
match:
topics: ["job.openclaw.prompt_build"]
risk_tags: ["prompt_pii"]
decision: allow_with_constraints
constraints:
kind: prompt_pii_redact$ openclaw cordclaw simulate --tool exec --command "echo hello"
Decision: ALLOW
Reason: OpenClaw tool calls are allowed by default after explicit deny rules.
$ openclaw cordclaw simulate --tool exec \
--command "echo cm0gLXJmIC8= | base64 -d | sh"
Decision: DENY
Reason: destructive command detected after canonicalization
$ openclaw cordclaw audit --limit 3
TOPIC DECISION REASON
job.openclaw.prompt_build CONSTRAIN prompt_pii_redact
job.openclaw.agent_start DENY cron-origin-policy-mismatch
job.openclaw.message_write DENY slack.upload_file exfil-riskStart with local setup and simulations. The connected path for centralized Agent Control Plane visibility remains in progress.
cd setup OPENCLAW_SKIP=true ./install.sh openclaw cordclaw simulate --tool exec --command "echo hello" openclaw cordclaw simulate --tool exec --command "rm -rf /" openclaw cordclaw audit --limit 20
Agent Control Plane
Start with Cordum Edge / CordClaw local pre-dispatch enforcement. The connected path for tenant-wide policy operations, approval gates, and job-level visibility remains in progress.
Pre-dispatch architecture, comparisons, and OpenClaw-specific operational guides.
A complete guide to secure OpenClaw agents in production with deterministic pre-dispatch governance, approval gates, fail-mode controls, and audit evidence.
A step-by-step tutorial for adding policy checks, approvals, and audit trails to OpenClaw workflows using an agent control plane.
A technical comparison of pre-dispatch governance for AI agents and post-hoc safety with real control-plane timing, fail modes, and validation checks.
Microsoft AGT, Galileo, and APort run in-process. Cordum runs out-of-process. Why trust boundary separation decides whether your AI agent governance survives compromise — and what regulated buyers' auditors expect.