pi-governance: RBAC, DLP, and audit logging for OpenClaw coding agents
pi-governance is a new OpenClaw plugin that addresses security concerns with AI coding agents having unrestricted system access. The tool was created by a developer who grew tired of agents having full access to terminals, filesystems, and secrets during daily use.
How it works
The plugin sits between your coding agent and your system, intercepting and classifying every tool call. It blocks potentially risky operations based on its analysis.
Key features
- Bash command blocking
- DLP (Data Loss Prevention) scanning for secrets and PII
- Role-based access control (RBAC)
- Structured audit logging
- Works out of the box with zero configuration
Installation
Install using the OpenClaw plugin command:
openclaw plugins install @grwnd/openclaw-governanceThe developer is seeking feedback on what additional controls users might want from such a governance framework.
📖 Read the full source: r/openclaw
👀 See Also
Claude implements identity verification for certain use cases
Anthropic is rolling out identity verification for Claude through Persona Identities, requiring government-issued photo IDs and live selfies. The verification process takes under five minutes and is used to prevent abuse and comply with legal obligations.
Analysis of Claude Code's Instrumentation and Telemetry Capabilities
A source code analysis reveals Claude Code implements extensive behavior tracking including keyword-based sentiment classification, permission prompt hesitation monitoring, and detailed environment fingerprinting.
Secure and Protect OpenClaw in Just 2 Minutes with Nono Kernel-Based Isolation
OpenClaw users can now enjoy enhanced security without compromising performance, thanks to Nono kernel-based isolation, a quick and effective solution that takes just two minutes.
Security Alert for Local OpenClaw Instances Without Sandboxing
A Reddit post warns that running vanilla OpenClaw instances locally without proper isolation can lead to exposed API keys, accidental file deletion, and data leaks. The source recommends sandboxing bash tools or using a managed service.