Verifiedon 2026.7.1
Action boundary
Before you act
- Expected result
- A documented allowlist limits each tool, file path, destination, extension, and elevation path to a reviewed purpose.
- Failure mode
- A broad host, filesystem, network, plugin, or skill permission becomes reachable from untrusted input.
- Rollback
- Disable the new extension or exposure, restore the prior reviewed allowlist, and verify no residual process remains.
Capability is the blast radius
Sandboxing, tool policy, and elevated execution solve different problems; do not treat one as proof that the others are safe. Consult the current OpenClaw sandboxing comparison, exposure runbook, plugin, and skills documentation before enabling a capability. A plugin or skill deserves the same review as an external dependency: provenance, version, requested authority, data flows, update path, and removal plan.
Lab — least-privilege allowlist
For every tool, document: purpose; invoking identities; exact input boundary; files it may read/write; approved network destinations; whether it can create an external effect; approval rule; logs; kill switch; and owner. Default to no access until there is a named use case.
Review network exposure separately. Record bind/interface, firewall or private-network boundary, proxy trust, authentication, discovery path, and a test from an untrusted network. “It is behind a URL” is not a network control.
Learner artifact
Use concentric rings: untrusted input → agent reasoning → policy/approval → sandboxed tool → narrowly scoped service. Put filesystem and network allowlists on the tool-to-service edge; put extension provenance at the plugin/skill boundary.
Checkpoint
A useful test is to give the sandboxed tool an unapproved destination or file path and confirm denial without attempting a harmful operation. If denial cannot be observed, the control is not yet auditable.
Review gate
No plugin, skill, or elevated path ships without a rollback owner and removal test. Pin or otherwise identify the reviewed version; update review is a new decision, not an automatic entitlement.
Source provenanceVerification and sources
Review receipt rr_security_tool_network_isolation
- Outcome
- approved
- Method
- source-review
- Reviewer
- academy-security-source-review
- Reviewed
Evidence
- openclaw-docs-index — docs-sandboxing-2026-07-30; snapshot
ec0905208fe0…
Limitations
- Approval covers the bounded 2026.7.1 learning exercises and cited security guidance; operators must validate controls against their own deployment and use disposable credentials in labs.
Lesson checkpoint
Ready to move on?
Mark this lesson complete when you can apply its outcome without relying on the examples above.