Define a first agent that can only propose

Verifiedon 2026-07-302026.7.1-2

Build a proposal, not an automaton

Your first agent has one controlled input and one controlled output. A suitable task: read a locally created test brief and propose a three-item checklist. It may not send a message, open a ticket, modify a repository, browse a private account, or execute a command outside the test boundary.

The agent CLI documentation distinguishes Gateway-backed turns from isolated openclaw agent exec runs. For this course, use agent exec with a dedicated working directory and an explicit config boundary. --isolated ignores ambient configuration; --auth-env-only uses only provider credentials already present in the process environment. Do not combine those modes. The course’s safety rule stays the same: a result is a proposal until a human explicitly approves a separate action.

Lab: write the task contract

Create a local card with six fields:

1. Purpose: summarize the controlled test brief into three proposed checks.
2. Allowed input: one locally created, non-sensitive text file.
3. Allowed output: a proposal shown to the trusted operator.
4. Forbidden actions: sending, publishing, purchasing, deleting, editing external systems, or accessing a real channel.
5. Approval: a named human must approve any later external action in a separate step.
6. Audit note: time, input label, proposal outcome, approval decision, and teardown result—no secret or private content.

Create the dedicated directory, place only the synthetic brief and task card inside it, then run one of these reviewed forms:

openclaw agent exec --isolated --cwd ./openclaw-first-agent-lab --message-file task.md --json

openclaw agent exec --auth-env-only --cwd ./openclaw-first-agent-lab --message-file task.md --json

Use the first only when its isolated defaults have an approved provider path; use the second only with a revocable provider key in the process environment. Stop on a non-zero exit, timeout, unexpected tool request, or access outside the dedicated directory.

Checkpoint: spot the unsafe contract

“Read my inbox, identify urgent items, and email the team a summary” fails this lesson: its input is not controlled, recipients are real, and it allows delivery. Rewrite it as a local mock inbox exercise that produces a draft for the operator only.