Security.
Each agent runs with its own identity and the access assigned to it, and every release shows how it was made. Here is how OpenClaw Enterprise and RAW Labs make sure of it.
Every agent, accounted for.
OpenClaw Enterprise’s team built these controls into its control plane, in the open: who each agent is, what it may use, and a record of what changed.
-
Its own identity
Each agent has an identity of its own, apart from the person who created or deployed it, and doesn’t inherit that person’s permissions.
-
Exact permissions
Roles set who may inspect, edit, deploy or administer each agent, across a namespace or on a single resource, and restrictions narrow them.
-
Credentials apart
Secrets are stored apart from configuration and kept out of revisions, responses and the audit log. Using one takes its own grant, for the deployer and the agent alike.
-
The record
Each deployment is saved as a revision that never changes, and the audit log records who made each change, every permission refused and each deployment’s outcome.
Contained where it runs.
On Kubernetes, every team gets a namespace of its own, held to the strictest of Kubernetes’ pod security standards, with its own quotas, limits and network rules.
-
Closed by default
Each namespace denies network traffic both ways unless a rule allows it. Agents may call public services on port 443, never private networks or cloud metadata, and no gateway can reach another agent.
-
Locked-down workloads
Agents and the control plane run as non-root, with every Linux capability dropped, no privilege escalation, read-only root filesystems, seccomp and resource limits.
-
Pinned images
Production takes only images pinned by digest, so each workload runs exactly the image that was released. A mutable tag is refused.
-
Tools run apart
A Coding agent runs its tools in a Codex workload of its own, with its own service account and storage, and its gateway never receives the model key.
Built in public. Checked before it ships.
This part is RAW Labs’ work, and all of it is public: the repository, the build and the records of every check.
-
Pinned
Each release names the exact OpenClaw Enterprise and OpenClaw commits it is built from, and every package and patch it adds by its hash.
-
Tested
Its images are built natively for AMD64 and ARM64 and must pass the controller, runtime and credential isolation tests, with confinement on and no test skipped.
-
Installed
Each release is installed from its own archive on a disposable cluster, where its encrypted database connection and authenticated access are checked.
-
Published for good
It ships with its SHA-256 checksum and a provenance record, its images pinned by digest. It never changes: fixes come as new releases.
Every part has an owner.
What an agent can do comes down to its platform permissions, its runtime privileges, the credentials it holds and what each connected application allows. Each part has its own owner.
- OpenClaw Enterprise
- How the platform behaves: identity, permissions, isolation and the audit log.
- RAW Labs
- What goes into each release and how it is built, checked and handed over, and, under an agreement, the support behind it.
- Plugin owners
- How each plugin works with its provider.
- Your installation’s operator
- The cluster, the accounts, the credentials, the backups and the acceptance checks: your team, or RAW Labs when it operates the platform for you.
Cluster administrators stay privileged: they can change what a workload receives, so their access needs governing of its own. Reviewing and building that setup is the work RAW Labs takes on.