CLI commands
Policy
openclaw policy
openclaw policy is provided by the bundled Policy plugin. It is an enterprise
conformance layer over existing OpenClaw settings, not a second configuration
system. You author requirements in policy.jsonc; OpenClaw observes the active
workspace as evidence; policy reports drift through doctor --lint. Policy
does not enforce tool calls or rewrite runtime behavior at request time, and it
does not attest per-agent credential stores such as openclaw-agent.sqlite.
Policy checks configured channels, MCP servers, model providers, network SSRF
posture, ingress/channel access, Gateway exposure and node command posture,
authored message-routing probes,
agent workspace access, sandbox posture, data-handling posture, secret
provider/auth profile posture, and governed tool metadata (the ## Tools section of AGENTS.md). Use it
when a workspace needs a durable, checkable statement such as "Telegram must
not be enabled" or "governed tools must declare risk and owner metadata." If
you only need local behavior with no attestation or drift detection, plain
config is enough.
Separately, openclaw agent exec applies an isolated
implicit policy config for each run: the agent sandbox is off, Gateway-host
execution is fully allowed, and filesystem tools are restricted to --cwd.
Detailed topics
Enable the plugin and write policy.jsonc, with an example covering every section.
Every rule namespace, the OpenClaw state it observes, and when to use it.
Hold named agents or channels to stricter rules than the baseline.
policy check, policy compare, and the plugin config behind them.
Evidence, attestation hashes, and policy watch drift detection.
Every check id, what doctor --fix repairs, and exit codes.
Related
- Doctor lint mode
- Path CLI
- Policy plugin reference — the plugin that adds these policy-backed doctor checks
