Policy

Policy 문서는 OpenClaw 공식 문서(cli/policy)를 한국어로 정리한 가이드입니다. CLI reference for openclaw policy conformance checks 명령·설정 키·코드 예시는 공식 문서를 그대로 보존하며, 해석과 절차 안내는 한국어로 제공합니다. 최종 동작은 설치된 CLI 버전과 공식 원문을 확인하세요.

핵심 요약

CLI reference for openclaw policy conformance checks

한국어 가이드 범위: cli/policy 경로의 설정·명령·제약·예시를 학습용으로 재구성합니다.

문서 구성

공식 문서의 주요 섹션은 다음과 같습니다.

빠른 시작
Policy rule reference
Run checks
Configure policy
Accept policy state
Findings
Repair
Exit codes
관련 문서

상세 내용

openclaw policy

openclaw policy is provided by the bundled Policy plugin. It is an enterprise conformance layer over existing OpenClaw settings, not a second configuration system. You author requirements in policy.jsonc; OpenClaw observes the active workspace as evidence; policy reports drift through doctor --lint. Policy does not enforce tool calls or rewrite runtime behavior at request time, and it does not attest per-agent credential stores such as auth-profiles.json.

빠른 시작

The plugin stays enabled even when policy.jsonc is missing, so doctor can report the missing artifact instead of silently skipping checks.

주요 항목:

Omitting gateway.bind while denying non-loopback binds means you accept
For a read-only agent, set sandbox mode to all or non-main on the
agents.workspace.denyTools accepts exec, process, write, edit,
Exec-approvals checks read the live exec-approvals.json artifact only when
Secret and auth-profile evidence records provider/source posture and
Data-handling evidence is config-level posture only (redaction mode,
Routing probes reuse OpenClaw's runtime binding resolver. Routing evidence

openclaw plugins enable policy

{
  "channels": {
    "denyRules": [
      {
        "id": "no-telegram",
        "when": { "provider": "telegram" },
        "reason": "Telegram is not approved for this workspace.",
      },
    ],
  },
  "mcp": {
    "servers": {
      "allow": ["docs"],
      "deny": ["untrusted"],
    },
  },
  "models": {
    "providers": {
      "allow": ["openai", "anthropic"],
      "deny": ["openrouter"],
    },
  },
  "network": {
    "privateNetwork": {
      "allow": false,
    },
  },
  "routing": {
    "requireBindings": true,
    "requireConfiguredChannels": true,
    "probes": [
      {
        "id": "family-dm",
        "route": {
          "channel": "imessage",
          "peer": { "kind": "direct", "id": "+15555550123" },
        },
        "expect": {
          "agentId": "family",
          "matchedBy": ["binding.peer"],
        },
      },
    ],
  },
  "ingress": {
    "session": {
      "requireDmScope": "per-channel-peer",
    },
    "channels": {
      "allowDmPolicies": ["pairing", "allowlist", "disabled"],
      "denyOpenGroups": true,
      "requireMentionInGroups": true,
    },
  },
  "gateway": {
    "exposure": {
      "allowNonLoopbackBind": false,
      "allowTailscaleFunnel": false,
    },
    "auth": {
      "requireAuth": true,
      "requireExplicitRateLimit": true,
    },
    "controlUi": {
      "allowInsecure": false,
    },
    "remote": {
      "allow": false,
    },
    "http": {
      "denyEndpoints": ["chatCompletions", "responses"],
      "requireUrlAllowlists": true,
    },
    "nodes": {
      "denyCommands": ["system.run"],
    },
  },
  "agents": {
    "workspace": {
      "allowedAccess": ["none", "ro"],
      "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
    },
  },
  "dataHandling": {
    "sensitiveLogging": {
      "requireRedaction": true,
    },
    "telemetry": {
      "denyContentCapture": true,
    },
    "retention": {
      "requireSessionMaintenance": true,
    },
    "memory": {
      "denySessionTranscriptIndexing": true,
    },
  },
  "secrets": {
    "requireManagedProviders": true,
    "denySources": ["exec"],
    "allowInsecureProviders": false,
  },
  "auth": {
    "profiles": {
      "requireMetadata": ["provider", "mode"],
      "allowModes": ["api_key", "token"],
    },
  },
  "execApprovals": {
    "requireFile": true,
    "defaults": { "allowSecurity": ["deny"] },
    "agents": {
      "allowSecurity": ["deny", "allowlist"],
      "allowAutoAllowSkills": false,
      "allowlist": { "expected": ["deploy", "status"] },
    },
  },
  "tools": {
    "requireMetadata": ["risk", "sensitivity", "owner"],
    "profiles": {
      "allow": ["messaging", "minimal"],
    },
    "fs": {
      "requireWorkspaceOnly": true,
    },
    "exec": {
      "allowSecurity": ["deny", "allowlist"],
      "requireAsk": ["always"],
      "allowHosts": ["sandbox"],
    },
    "elevated": {
      "allow": false,
    },
    "denyTools": ["group:runtime", "group:fs"],
  },
}

Policy rule reference

Every rule below is optional; a check runs only when the rule is present. The observed state is existing OpenClaw config or workspace metadata.

Selector	Supported sections	Use when
`agentIds`	`tools`, `agents.workspace`, `sandbox`, `dataHandling.memory`, `execApprovals`	One or more runtime agents need stricter rules.
`channelIds`	`ingress.channels`	One or more channels need stricter ingress rules.

Policy field	Observed state	Use when
`channels.denyRules[].when.provider`	`channels.*` provider and enabled state	Deny configured channels from a provider such as `telegram`.
`channels.denyRules[].reason`	Finding message and repair hint context	Explain why the provider is denied.

Policy field	Observed state	Use when
`mcp.servers.allow`	`mcp.servers.*` ids	Require every configured MCP server to be in an allowlist.
`mcp.servers.deny`	`mcp.servers.*` ids	Deny specific configured MCP server ids.

{
  "tools": {
    "exec": {
      "allowHosts": ["sandbox", "node"],
    },
  },
  "sandbox": {
    "requireMode": ["all", "non-main"],
  },
  "scopes": {
    "release-workspace": {
      "agentIds": ["release-agent", "review-agent"],
      "agents": {
        "workspace": {
          "allowedAccess": ["none", "ro"],
        },
      },
    },
    "release-lockdown": {
      "agentIds": ["release-agent"],
      "tools": {
        "exec": {
          "allowHosts": ["sandbox"],
          "allowSecurity": ["deny", "allowlist"],
          "requireAsk": ["always"],
        },
        "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
      },
      "sandbox": {
        "requireMode": ["all"],
        "allowBackends": ["docker"],
      },
      "dataHandling": {
        "memory": {
          "denySessionTranscriptIndexing": true,
        },
      },
    },
    "shell-sandbox": {
      "agentIds": ["shell-agent"],
      "sandbox": {
        "allowBackends": ["openshell"],
        "containers": {
          "requireReadOnlyMounts": false,
        },
      },
    },
    "telegram-ingress": {
      "channelIds": ["telegram"],
      "ingress": {
        "channels": {
          "allowDmPolicies": ["pairing"],
          "denyOpenGroups": true,
          "requireMentionInGroups": true,
        },
      },
    },
  },
}

{
  "execApprovals": {
    "requireFile": true,
    "defaults": {
      // Security modes: "deny", "allowlist", or "full".
      // This default permits only the locked-down deny posture.
      "allowSecurity": ["deny"],
    },
  },
  "scopes": {
    "restricted-shell": {
      "agentIds": ["family-agent", "groups-agent"],
      "execApprovals": {
        "agents": {
          // Selected agents may use reviewed allowlist posture, but not "full".
          "allowSecurity": ["allowlist"],
          // false means skill CLIs must appear in the reviewed allowlist instead of
          // being implicitly approved by autoAllowSkills.
          "allowAutoAllowSkills": false,
          "allowlist": {
            "expected": [
              // Simple entry: exact reviewed executable pattern with no argPattern.
              "travel-hub",
              // Constrained entry: pattern plus reviewed argument regex.
              { "pattern": "calendar-cli", "argPattern": "^sync\\b" },
              "/bin/date",
            ],
          },
        },
      },
    },
  },
}

Run checks

policy check runs only the policy check set and emits evidence, findings, and attestation hashes. The same findings also appear in openclaw doctor --lint when the Policy plugin is enabled.

openclaw policy check
openclaw policy check --json
openclaw policy check --severity-min error

openclaw policy compare --baseline official.policy.jsonc
openclaw policy compare --baseline official.policy.jsonc --policy policy.jsonc --json

{
  "ok": true,
  "baselinePath": "official.policy.jsonc",
  "policyPath": "policy.jsonc",
  "rulesChecked": 3,
  "findings": []
}

{
  "ok": true,
  "attestation": {
    "policy": {
      "path": "policy.jsonc",
      "hash": "sha256:..."
    },
    "workspace": {
      "scope": "policy",
      "hash": "sha256:..."
    },
    "findingsHash": "sha256:...",
    "attestationHash": "sha256:..."
  },
  "checksRun": 5,
  "checksSkipped": 0,
  "findings": []
}

Configure policy

Policy config lives under plugins.entries.policy.config.

Setting	Purpose
`enabled`	Enable policy checks even before `policy.jsonc` exists.
`workspaceRepairs`	Allow `doctor --fix` to edit policy-managed workspace settings.
`expectedHash`	Optional hash-lock for the approved policy artifact.
`expectedAttestationHash`	Optional hash-lock for the last accepted clean policy check.
`path`	Workspace-relative location of the policy artifact.

{
  "plugins": {
    "entries": {
      "policy": {
        "enabled": true,
        "config": {
          "enabled": true,
          "path": "policy.jsonc",
          "workspaceRepairs": false,
          "expectedHash": "sha256:...",
          "expectedAttestationHash": "sha256:...",
        },
      },
    },
  },
}

Accept policy state

attestation.policy.hash identifies the authored rule artifact. evidence records the observed OpenClaw state used by the checks, and workspace.hash identifies that evidence payload. findingsHash identifies the exact finding set. checkedAt records when the check ran. attestationHash identifies the stable claim (policy hash, evidence hash, findings hash, and clean/dirty state) and deliberately excludes checkedAt, so the same policy state always produces the same attestation hash. Together these four values form the audit tuple for one policy check.

{
  "ok": true,
  "attestation": {
    "checkedAt": "2026-05-10T20:00:00.000Z",
    "policy": {
      "path": "policy.jsonc",
      "hash": "sha256:..."
    },
    "workspace": {
      "scope": "policy",
      "hash": "sha256:..."
    },
    "findingsHash": "sha256:...",
    "attestationHash": "sha256:..."
  },
  "evidence": {
    "channels": [
      {
        "id": "telegram",
        "provider": "telegram",
        "source": "oc://openclaw.config/channels/telegram",
        "enabled": false
      }
    ],
    "mcpServers": [
      {
        "id": "docs",
        "transport": "stdio",
        "source": "oc://openclaw.config/mcp/servers/docs",
        "command": "npx"
      }
    ],
    "modelProviders": [
      {
        "id": "openai",
        "source": "oc://openclaw.config/models/providers/openai"
      }
    ],
    "modelRefs": [
      {
        "ref": "openai/gpt-5.6-sol",
        "provider": "openai",
        "model": "gpt-5.6-sol",
        "source": "oc://openclaw.config/agents/defaults/model"
      }
    ],
    "network": [
      {
        "id": "browser-private-network",
        "source": "oc://openclaw.config/browser/ssrfPolicy/dangerouslyAllowPrivateNetwork",
        "value": false
      }
    ],
    "gatewayExposure": [
      {
        "id": "gateway-bind",
        "kind": "bind",
        "source": "oc://openclaw.config/gateway/bind",
        "value": "loopback",
        "nonLoopback": false,
        "explicit": true
      }
    ],
    "agentWorkspace": [
      {
        "id": "agents-defaults-workspace-access",
        "kind": "workspaceAccess",
        "source": "oc://openclaw.config/agents/defaults/sandbox/workspaceAccess",
        "scope": "defaults",
        "value": "ro",
        "sandboxMode": "all",
        "sandboxModeSource": "oc://openclaw.config/agents/defaults/sandbox/mode",
        "sandboxEnabled": true,
        "explicit": true
      },
      {
        "id": "agents-defaults-tool-exec",
        "kind": "toolDeny",
        "source": "oc://openclaw.config/tools/deny",
        "scope": "defaults",
        "tool": "exec",
        "denied": true,
        "explicit": true
      }
    ],
    "secrets": [
      {
        "id": "vault",
        "kind": "provider",
        "source": "oc://openclaw.config/secrets/providers/vault",
        "providerSource": "env"
      },
      {
        "id": "oc://openclaw.config/models/providers/openai/apiKey",
        "kind": "input",
        "source": "oc://openclaw.config/models/providers/openai/apiKey",
        "provenance": "secretRef",
        "refSource": "env",
        "refProvider": "vault"
      }
    ],
    "authProfiles": [
      {
        "id": "github",
        "source": "oc://openclaw.config/auth/profiles/github",
        "validMetadata": true,
        "provider": "github",
        "mode": "token"
      }
    ],
    "tools": [
      {
        "id": "deploy",
        "source": "oc://TOOLS.md/tools/deploy",
        "line": 12,
        "risk": "critical",
        "sensitivity": "restricted",
        "capabilities": ["IRREVERSIBLE_EXTERNAL"]
      }
    ]
  },
  "checksRun": 30,
  "checksSkipped": 0,
  "findings": []
}

openclaw policy watch --json

Findings

A finding can include both target (the observed workspace thing that does not conform) and requirement (the authored rule that made it a finding). Both are oc:// address strings today, but the field names describe policy role rather than address format.

Check id	Finding
`policy/policy-jsonc-missing`	Policy is enabled but `policy.jsonc` is missing.
`policy/policy-jsonc-invalid`	Policy cannot be parsed or contains malformed rule entries.
`policy/policy-hash-mismatch`	Policy does not match configured `expectedHash`.
`policy/attestation-hash-mismatch`	Current policy evidence no longer matches the accepted attestation.
`policy/policy-conformance-invalid`	A baseline or checked policy file has invalid comparison syntax.
`policy/policy-conformance-missing`	A checked policy file is missing a rule required by the baseline policy file.
`policy/policy-conformance-weaker`	A checked policy file has a weaker value than the baseline policy file.
`policy/channels-denied-provider`	An enabled channel matches a channel deny rule.
`policy/mcp-denied-server`	A configured MCP server is denied by policy.
`policy/mcp-unapproved-server`	A configured MCP server is outside the allowlist.
`policy/models-denied-provider`	A configured model provider or model ref uses a denied provider.
`policy/models-unapproved-provider`	A configured model provider or model ref is outside the allowlist.
`policy/network-private-access-enabled`	A private-network SSRF escape hatch is enabled when policy denies it.
`policy/routing-bindings-required`	Policy requires a channel route binding, but none is configured.
`policy/routing-binding-channel-unconfigured`	A route binding names a channel absent from `channels.*`.
`policy/routing-agent-mismatch`	An authored route resolves to a different agent.
`policy/routing-match-kind-mismatch`	An authored route matches at an unexpected binding specificity.
`policy/ingress-dm-policy-unapproved`	A channel DM policy is outside the policy allowlist.
`policy/ingress-dm-scope-unapproved`	`session.dmScope` does not match the policy-required DM isolation scope.
`policy/ingress-open-groups-denied`	A channel group policy is `open` while policy denies open group ingress.
`policy/ingress-group-mention-required`	A channel or group entry disables mention gates while policy requires them.
`policy/gateway-non-loopback-bind`	Gateway bind posture permits non-loopback exposure when policy denies it.
`policy/gateway-auth-disabled`	Gateway authentication is disabled when policy requires auth.
`policy/gateway-rate-limit-missing`	Gateway auth rate-limit posture is not explicit when policy requires it.
`policy/gateway-control-ui-insecure`	Gateway Control UI insecure exposure toggles are enabled.
`policy/gateway-tailscale-funnel`	Gateway Tailscale Funnel exposure is enabled when policy denies it.
`policy/gateway-remote-enabled`	Gateway remote mode is active when policy denies it.
`policy/gateway-http-endpoint-enabled`	A Gateway HTTP API endpoint is enabled while denied by policy.
`policy/gateway-http-url-fetch-unrestricted`	Gateway HTTP URL-fetch input lacks a required URL allowlist.
`policy/gateway-node-command-denied`	A node command denied by policy is not denied by OpenClaw config.
`policy/agents-workspace-access-denied`	Agent sandbox mode or workspace access is outside the policy allowlist.
`policy/agents-tool-not-denied`	An agent or default config does not deny a tool required by policy.
`policy/tools-profile-unapproved`	A configured global or per-agent tool profile is outside the allowlist.
`policy/tools-fs-workspace-only-required`	Filesystem tools are not configured with workspace-only path posture.
`policy/tools-exec-security-unapproved`	Exec security mode is outside the policy allowlist.
`policy/tools-exec-ask-unapproved`	Exec ask mode is outside the policy allowlist.
`policy/tools-exec-host-unapproved`	Exec host routing is outside the policy allowlist.
`policy/tools-elevated-enabled`	Elevated tool mode is enabled when policy denies it.
`policy/tools-also-allow-missing`	A configured `alsoAllow` list is missing an entry required by policy.
`policy/tools-also-allow-unexpected`	A configured `alsoAllow` list includes an entry not expected by policy.
`policy/tools-required-deny-missing`	A global or per-agent tool deny list does not include a required denied tool.
`policy/sandbox-mode-unapproved`	Sandbox mode is outside the policy allowlist.
`policy/sandbox-backend-unapproved`	Sandbox backend is outside the policy allowlist.
`policy/sandbox-container-posture-unobservable`	A container posture rule is enabled for a backend that cannot observe it.
`policy/sandbox-container-host-network-denied`	A container-backed sandbox or browser uses host network mode.
`policy/sandbox-container-namespace-join-denied`	A container-backed sandbox or browser joins another container namespace.
`policy/sandbox-container-mount-mode-required`	A container-backed sandbox or browser mount is not read-only.
`policy/sandbox-container-runtime-socket-mount`	A container-backed sandbox or browser mount exposes the container runtime socket.
`policy/sandbox-container-unconfined-profile`	Container sandbox profile is unconfined when policy denies it.
`policy/sandbox-browser-cdp-source-range-missing`	Sandbox browser CDP source range is missing when policy requires one.
`policy/data-handling-redaction-disabled`	Sensitive logging redaction is disabled when policy requires it.
`policy/data-handling-telemetry-content-capture`	Telemetry content capture is enabled when policy denies it.
`policy/data-handling-session-retention-not-enforced`	Session retention maintenance is not enforced when policy requires it.
`policy/data-handling-session-transcript-memory-enabled`	Session transcript memory indexing is enabled when policy denies it.
`policy/secrets-unmanaged-provider`	A config SecretRef references a provider not declared under `secrets.providers`.
`policy/secrets-denied-provider-source`	A config secret provider or SecretRef uses a source denied by policy.
`policy/secrets-insecure-provider`	A secret provider opts into insecure posture when policy denies it.
`policy/auth-profile-invalid-metadata`	A config auth profile is missing valid provider or mode metadata.
`policy/auth-profile-unapproved-mode`	A config auth profile mode is outside the policy allowlist.
`policy/exec-approvals-missing`	Policy requires `exec-approvals.json`, but the artifact is missing.
`policy/exec-approvals-invalid`	The configured exec approvals artifact cannot be parsed.
`policy/exec-approvals-default-security-unapproved`	Exec approval defaults use a security mode outside the policy allowlist.
`policy/exec-approvals-agent-security-unapproved`	A per-agent effective exec approval security mode is outside the allowlist.
`policy/exec-approvals-auto-allow-skills-enabled`	An exec approval agent implicitly auto-allows skill CLIs when policy denies it.
`policy/exec-approvals-allowlist-missing`	The approvals allowlist is missing a pattern required by policy.
`policy/exec-approvals-allowlist-unexpected`	The approvals allowlist includes a pattern not expected by policy.
`policy/tools-missing-risk-level`	A governed tool declaration is missing risk metadata.
`policy/tools-unknown-risk-level`	A governed tool declaration uses an unknown risk value.
`policy/tools-missing-sensitivity-token`	A governed tool declaration is missing sensitivity metadata.
`policy/tools-missing-owner`	A governed tool declaration is missing owner metadata.
`policy/tools-unknown-sensitivity-token`	A governed tool declaration uses an unknown sensitivity value.

{
  "checkId": "policy/channels-denied-provider",
  "severity": "error",
  "message": "Channel 'telegram' uses denied provider 'telegram'.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/channels/telegram",
  "target": "oc://openclaw.config/channels/telegram",
  "requirement": "oc://policy.jsonc/channels/denyRules/#0",
  "fixHint": "Telegram is not approved for this workspace."
}

{
  "checkId": "policy/tools-missing-risk-level",
  "severity": "error",
  "message": "TOOLS.md tool 'deploy' has no explicit risk classification.",
  "source": "policy",
  "path": "TOOLS.md",
  "line": 12,
  "ocPath": "oc://TOOLS.md/tools/deploy",
  "target": "oc://TOOLS.md/tools/deploy",
  "requirement": "oc://policy.jsonc/tools/requireMetadata"
}

{
  "checkId": "policy/mcp-unapproved-server",
  "severity": "error",
  "message": "MCP server 'remote' is not in the policy allowlist.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/mcp/servers/remote",
  "target": "oc://openclaw.config/mcp/servers/remote",
  "requirement": "oc://policy.jsonc/mcp/servers/allow"
}

{
  "checkId": "policy/models-unapproved-provider",
  "severity": "error",
  "message": "Model ref 'anthropic/claude-sonnet-4.7' uses unapproved provider 'anthropic'.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/agents/defaults/model/fallbacks/#0",
  "target": "oc://openclaw.config/agents/defaults/model/fallbacks/#0",
  "requirement": "oc://policy.jsonc/models/providers/allow"
}

Repair

doctor --lint and policy check are read-only.

주요 항목:

set tools.elevated.enabled=false when a global policy forbids elevated tools
add missing required-deny tool ids to tools.deny or
set insecure gateway.controlUi.* toggles to false
set gateway.mode=local when policy denies remote gateway mode
set reported gateway.http.endpoints.*.enabled paths to false when policy
set reported channel ingress groupPolicy paths to allowlist when policy
set reported channel ingress requireMention paths to true when policy
set logging.redactSensitive=tools when policy requires sensitive logging
set diagnostics.otel.captureContent=false, or

{
  "plugins": {
    "entries": {
      "policy": {
        "config": {
          "workspaceRepairs": true,
        },
      },
    },
  },
}

Exit codes

Command	`0`	`1`	`2`
`policy check`	No findings at the threshold.	One or more findings met the threshold.	Argument or runtime failure.
`policy compare`	The policy file is at least as strict as the baseline.	The policy file is invalid, missing, or weaker than baseline rules.	Argument or runtime failure.
`policy watch`	No findings and accepted hash is current.	Findings exist or accepted attestation is stale.	Argument or runtime failure.

실습 체크리스트

공식 문서와 로컬 버전을 대조합니다: https://docs.openclaw.ai/cli/policy
관련 CLI는 openclaw --help 및 하위 명령 --help로 옵션을 확인합니다.
설정 변경 시 openclaw config / openclaw doctor로 유효성을 검사합니다.
Gateway·채널·플러그인 변경 후에는 필요 시 Gateway를 재시작합니다.

자주 쓰는 명령·설정 예시

openclaw plugins enable policy

{
  "channels": {
    "denyRules": [
      {
        "id": "no-telegram",
        "when": { "provider": "telegram" },
        "reason": "Telegram is not approved for this workspace.",
      },
    ],
  },
  "mcp": {
    "servers": {
      "allow": ["docs"],
      "deny": ["untrusted"],
    },
  },
  "models": {
    "providers": {
      "allow": ["openai", "anthropic"],
      "deny": ["openrouter"],
    },
  },
  "network": {
    "privateNetwork": {
      "allow": false,
    },
  },
  "routing": {
    "requireBindings": true,
    "requireConfiguredChannels": true,
    "probes": [
      {
        "id": "family-dm",
        "route": {
          "channel": "imessage",
          "peer": { "kind": "direct", "id": "+15555550123" },
        },
        "expect": {
          "agentId": "family",
          "matchedBy": ["binding.peer"],
        },
      },
    ],
  },
  "ingress": {
    "session": {
      "requireDmScope": "per-channel-peer",
    },
    "channels": {
      "allowDmPolicies": ["pairing", "allowlist", "disabled"],
      "denyOpenGroups": true,
      "requireMentionInGroups": true,
    },
  },
  "gateway": {
    "exposure": {
      "allowNonLoopbackBind": false,
      "allowTailscaleFunnel": false,
    },
    "auth": {
      "requireAuth": true,
      "requireExplicitRateLimit": true,
    },
    "controlUi": {
      "allowInsecure": false,
    },
    "remote": {
      "allow": false,
    },
    "http": {
      "denyEndpoints": ["chatCompletions", "responses"],
      "requireUrlAllowlists": true,
    },
    "nodes": {
      "denyCommands": ["system.run"],
    },
  },
  "agents": {
    "workspace": {
      "allowedAccess": ["none", "ro"],
      "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
    },
  },
  "dataHandling": {
    "sensitiveLogging": {
      "requireRedaction": true,
    },
    "telemetry": {
      "denyContentCapture": true,
    },
    "retention": {
      "requireSessionMaintenance": true,
    },
    "memory": {
      "denySessionTranscriptIndexing": true,
    },
  },
  "secrets": {
    "requireManagedProviders": true,
    "denySources": ["exec"],
    "allowInsecureProviders": false,
  },
  "auth": {
    "profiles": {
      "requireMetadata": ["provider", "mode"],
      "allowModes": ["api_key", "token"],
    },
  },
  "execApprovals": {
    "requireFile": true,
    "defaults": { "allowSecurity": ["deny"] },
    "agents": {
      "allowSecurity": ["deny", "allowlist"],
      "allowAutoAllowSkills": false,
      "allowlist": { "expected": ["deploy", "status"] },
    },
  },
  "tools": {
    "requireMetadata": ["risk", "sensitivity", "owner"],
    "profiles": {
      "allow": ["messaging", "minimal"],
    },
    "fs": {
      "requireWorkspaceOnly": true,
    },
    "exec": {
      "allowSecurity": ["deny", "allowlist"],
      "requireAsk": ["always"],
      "allowHosts": ["sandbox"],
    },
    "elevated": {
      "allow": false,
    },
    "denyTools": ["group:runtime", "group:fs"],
  },
}

{
  "tools": {
    "exec": {
      "allowHosts": ["sandbox", "node"],
    },
  },
  "sandbox": {
    "requireMode": ["all", "non-main"],
  },
  "scopes": {
    "release-workspace": {
      "agentIds": ["release-agent", "review-agent"],
      "agents": {
        "workspace": {
          "allowedAccess": ["none", "ro"],
        },
      },
    },
    "release-lockdown": {
      "agentIds": ["release-agent"],
      "tools": {
        "exec": {
          "allowHosts": ["sandbox"],
          "allowSecurity": ["deny", "allowlist"],
          "requireAsk": ["always"],
        },
        "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
      },
      "sandbox": {
        "requireMode": ["all"],
        "allowBackends": ["docker"],
      },
      "dataHandling": {
        "memory": {
          "denySessionTranscriptIndexing": true,
        },
      },
    },
    "shell-sandbox": {
      "agentIds": ["shell-agent"],
      "sandbox": {
        "allowBackends": ["openshell"],
        "containers": {
          "requireReadOnlyMounts": false,
        },
      },
    },
    "telegram-ingress": {
      "channelIds": ["telegram"],
      "ingress": {
        "channels": {
          "allowDmPolicies": ["pairing"],
          "denyOpenGroups": true,
          "requireMentionInGroups": true,
        },
      },
    },
  },
}

{
  "execApprovals": {
    "requireFile": true,
    "defaults": {
      // Security modes: "deny", "allowlist", or "full".
      // This default permits only the locked-down deny posture.
      "allowSecurity": ["deny"],
    },
  },
  "scopes": {
    "restricted-shell": {
      "agentIds": ["family-agent", "groups-agent"],
      "execApprovals": {
        "agents": {
          // Selected agents may use reviewed allowlist posture, but not "full".
          "allowSecurity": ["allowlist"],
          // false means skill CLIs must appear in the reviewed allowlist instead of
          // being implicitly approved by autoAllowSkills.
          "allowAutoAllowSkills": false,
          "allowlist": {
            "expected": [
              // Simple entry: exact reviewed executable pattern with no argPattern.
              "travel-hub",
              // Constrained entry: pattern plus reviewed argument regex.
              { "pattern": "calendar-cli", "argPattern": "^sync\\b" },
              "/bin/date",
            ],
          },
        },
      },
    },
  },
}

openclaw policy check
openclaw policy check --json
openclaw policy check --severity-min error

openclaw policy compare --baseline official.policy.jsonc
openclaw policy compare --baseline official.policy.jsonc --policy policy.jsonc --json

Policy

핵심 요약

CLI reference for openclaw policy conformance checks

한국어 가이드 범위: cli/policy 경로의 설정·명령·제약·예시를 학습용으로 재구성합니다.

문서 구성

공식 문서의 주요 섹션은 다음과 같습니다.

빠른 시작
Policy rule reference
Run checks
Configure policy
Accept policy state
Findings
Repair
Exit codes
관련 문서

상세 내용

openclaw policy

빠른 시작

The plugin stays enabled even when policy.jsonc is missing, so doctor can report the missing artifact instead of silently skipping checks.

주요 항목:

Omitting gateway.bind while denying non-loopback binds means you accept
For a read-only agent, set sandbox mode to all or non-main on the
agents.workspace.denyTools accepts exec, process, write, edit,
Exec-approvals checks read the live exec-approvals.json artifact only when
Secret and auth-profile evidence records provider/source posture and
Data-handling evidence is config-level posture only (redaction mode,
Routing probes reuse OpenClaw's runtime binding resolver. Routing evidence

openclaw plugins enable policy

{
  "channels": {
    "denyRules": [
      {
        "id": "no-telegram",
        "when": { "provider": "telegram" },
        "reason": "Telegram is not approved for this workspace.",
      },
    ],
  },
  "mcp": {
    "servers": {
      "allow": ["docs"],
      "deny": ["untrusted"],
    },
  },
  "models": {
    "providers": {
      "allow": ["openai", "anthropic"],
      "deny": ["openrouter"],
    },
  },
  "network": {
    "privateNetwork": {
      "allow": false,
    },
  },
  "routing": {
    "requireBindings": true,
    "requireConfiguredChannels": true,
    "probes": [
      {
        "id": "family-dm",
        "route": {
          "channel": "imessage",
          "peer": { "kind": "direct", "id": "+15555550123" },
        },
        "expect": {
          "agentId": "family",
          "matchedBy": ["binding.peer"],
        },
      },
    ],
  },
  "ingress": {
    "session": {
      "requireDmScope": "per-channel-peer",
    },
    "channels": {
      "allowDmPolicies": ["pairing", "allowlist", "disabled"],
      "denyOpenGroups": true,
      "requireMentionInGroups": true,
    },
  },
  "gateway": {
    "exposure": {
      "allowNonLoopbackBind": false,
      "allowTailscaleFunnel": false,
    },
    "auth": {
      "requireAuth": true,
      "requireExplicitRateLimit": true,
    },
    "controlUi": {
      "allowInsecure": false,
    },
    "remote": {
      "allow": false,
    },
    "http": {
      "denyEndpoints": ["chatCompletions", "responses"],
      "requireUrlAllowlists": true,
    },
    "nodes": {
      "denyCommands": ["system.run"],
    },
  },
  "agents": {
    "workspace": {
      "allowedAccess": ["none", "ro"],
      "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
    },
  },
  "dataHandling": {
    "sensitiveLogging": {
      "requireRedaction": true,
    },
    "telemetry": {
      "denyContentCapture": true,
    },
    "retention": {
      "requireSessionMaintenance": true,
    },
    "memory": {
      "denySessionTranscriptIndexing": true,
    },
  },
  "secrets": {
    "requireManagedProviders": true,
    "denySources": ["exec"],
    "allowInsecureProviders": false,
  },
  "auth": {
    "profiles": {
      "requireMetadata": ["provider", "mode"],
      "allowModes": ["api_key", "token"],
    },
  },
  "execApprovals": {
    "requireFile": true,
    "defaults": { "allowSecurity": ["deny"] },
    "agents": {
      "allowSecurity": ["deny", "allowlist"],
      "allowAutoAllowSkills": false,
      "allowlist": { "expected": ["deploy", "status"] },
    },
  },
  "tools": {
    "requireMetadata": ["risk", "sensitivity", "owner"],
    "profiles": {
      "allow": ["messaging", "minimal"],
    },
    "fs": {
      "requireWorkspaceOnly": true,
    },
    "exec": {
      "allowSecurity": ["deny", "allowlist"],
      "requireAsk": ["always"],
      "allowHosts": ["sandbox"],
    },
    "elevated": {
      "allow": false,
    },
    "denyTools": ["group:runtime", "group:fs"],
  },
}

Policy rule reference

Every rule below is optional; a check runs only when the rule is present. The observed state is existing OpenClaw config or workspace metadata.

Selector	Supported sections	Use when
`agentIds`	`tools`, `agents.workspace`, `sandbox`, `dataHandling.memory`, `execApprovals`	One or more runtime agents need stricter rules.
`channelIds`	`ingress.channels`	One or more channels need stricter ingress rules.

Policy field	Observed state	Use when
`channels.denyRules[].when.provider`	`channels.*` provider and enabled state	Deny configured channels from a provider such as `telegram`.
`channels.denyRules[].reason`	Finding message and repair hint context	Explain why the provider is denied.

Policy field	Observed state	Use when
`mcp.servers.allow`	`mcp.servers.*` ids	Require every configured MCP server to be in an allowlist.
`mcp.servers.deny`	`mcp.servers.*` ids	Deny specific configured MCP server ids.

{
  "tools": {
    "exec": {
      "allowHosts": ["sandbox", "node"],
    },
  },
  "sandbox": {
    "requireMode": ["all", "non-main"],
  },
  "scopes": {
    "release-workspace": {
      "agentIds": ["release-agent", "review-agent"],
      "agents": {
        "workspace": {
          "allowedAccess": ["none", "ro"],
        },
      },
    },
    "release-lockdown": {
      "agentIds": ["release-agent"],
      "tools": {
        "exec": {
          "allowHosts": ["sandbox"],
          "allowSecurity": ["deny", "allowlist"],
          "requireAsk": ["always"],
        },
        "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
      },
      "sandbox": {
        "requireMode": ["all"],
        "allowBackends": ["docker"],
      },
      "dataHandling": {
        "memory": {
          "denySessionTranscriptIndexing": true,
        },
      },
    },
    "shell-sandbox": {
      "agentIds": ["shell-agent"],
      "sandbox": {
        "allowBackends": ["openshell"],
        "containers": {
          "requireReadOnlyMounts": false,
        },
      },
    },
    "telegram-ingress": {
      "channelIds": ["telegram"],
      "ingress": {
        "channels": {
          "allowDmPolicies": ["pairing"],
          "denyOpenGroups": true,
          "requireMentionInGroups": true,
        },
      },
    },
  },
}

{
  "execApprovals": {
    "requireFile": true,
    "defaults": {
      // Security modes: "deny", "allowlist", or "full".
      // This default permits only the locked-down deny posture.
      "allowSecurity": ["deny"],
    },
  },
  "scopes": {
    "restricted-shell": {
      "agentIds": ["family-agent", "groups-agent"],
      "execApprovals": {
        "agents": {
          // Selected agents may use reviewed allowlist posture, but not "full".
          "allowSecurity": ["allowlist"],
          // false means skill CLIs must appear in the reviewed allowlist instead of
          // being implicitly approved by autoAllowSkills.
          "allowAutoAllowSkills": false,
          "allowlist": {
            "expected": [
              // Simple entry: exact reviewed executable pattern with no argPattern.
              "travel-hub",
              // Constrained entry: pattern plus reviewed argument regex.
              { "pattern": "calendar-cli", "argPattern": "^sync\\b" },
              "/bin/date",
            ],
          },
        },
      },
    },
  },
}

Run checks

policy check runs only the policy check set and emits evidence, findings, and attestation hashes. The same findings also appear in openclaw doctor --lint when the Policy plugin is enabled.

openclaw policy check
openclaw policy check --json
openclaw policy check --severity-min error

openclaw policy compare --baseline official.policy.jsonc
openclaw policy compare --baseline official.policy.jsonc --policy policy.jsonc --json

{
  "ok": true,
  "baselinePath": "official.policy.jsonc",
  "policyPath": "policy.jsonc",
  "rulesChecked": 3,
  "findings": []
}

{
  "ok": true,
  "attestation": {
    "policy": {
      "path": "policy.jsonc",
      "hash": "sha256:..."
    },
    "workspace": {
      "scope": "policy",
      "hash": "sha256:..."
    },
    "findingsHash": "sha256:...",
    "attestationHash": "sha256:..."
  },
  "checksRun": 5,
  "checksSkipped": 0,
  "findings": []
}

Configure policy

Policy config lives under plugins.entries.policy.config.

Setting	Purpose
`enabled`	Enable policy checks even before `policy.jsonc` exists.
`workspaceRepairs`	Allow `doctor --fix` to edit policy-managed workspace settings.
`expectedHash`	Optional hash-lock for the approved policy artifact.
`expectedAttestationHash`	Optional hash-lock for the last accepted clean policy check.
`path`	Workspace-relative location of the policy artifact.

{
  "plugins": {
    "entries": {
      "policy": {
        "enabled": true,
        "config": {
          "enabled": true,
          "path": "policy.jsonc",
          "workspaceRepairs": false,
          "expectedHash": "sha256:...",
          "expectedAttestationHash": "sha256:...",
        },
      },
    },
  },
}

Accept policy state

{
  "ok": true,
  "attestation": {
    "checkedAt": "2026-05-10T20:00:00.000Z",
    "policy": {
      "path": "policy.jsonc",
      "hash": "sha256:..."
    },
    "workspace": {
      "scope": "policy",
      "hash": "sha256:..."
    },
    "findingsHash": "sha256:...",
    "attestationHash": "sha256:..."
  },
  "evidence": {
    "channels": [
      {
        "id": "telegram",
        "provider": "telegram",
        "source": "oc://openclaw.config/channels/telegram",
        "enabled": false
      }
    ],
    "mcpServers": [
      {
        "id": "docs",
        "transport": "stdio",
        "source": "oc://openclaw.config/mcp/servers/docs",
        "command": "npx"
      }
    ],
    "modelProviders": [
      {
        "id": "openai",
        "source": "oc://openclaw.config/models/providers/openai"
      }
    ],
    "modelRefs": [
      {
        "ref": "openai/gpt-5.6-sol",
        "provider": "openai",
        "model": "gpt-5.6-sol",
        "source": "oc://openclaw.config/agents/defaults/model"
      }
    ],
    "network": [
      {
        "id": "browser-private-network",
        "source": "oc://openclaw.config/browser/ssrfPolicy/dangerouslyAllowPrivateNetwork",
        "value": false
      }
    ],
    "gatewayExposure": [
      {
        "id": "gateway-bind",
        "kind": "bind",
        "source": "oc://openclaw.config/gateway/bind",
        "value": "loopback",
        "nonLoopback": false,
        "explicit": true
      }
    ],
    "agentWorkspace": [
      {
        "id": "agents-defaults-workspace-access",
        "kind": "workspaceAccess",
        "source": "oc://openclaw.config/agents/defaults/sandbox/workspaceAccess",
        "scope": "defaults",
        "value": "ro",
        "sandboxMode": "all",
        "sandboxModeSource": "oc://openclaw.config/agents/defaults/sandbox/mode",
        "sandboxEnabled": true,
        "explicit": true
      },
      {
        "id": "agents-defaults-tool-exec",
        "kind": "toolDeny",
        "source": "oc://openclaw.config/tools/deny",
        "scope": "defaults",
        "tool": "exec",
        "denied": true,
        "explicit": true
      }
    ],
    "secrets": [
      {
        "id": "vault",
        "kind": "provider",
        "source": "oc://openclaw.config/secrets/providers/vault",
        "providerSource": "env"
      },
      {
        "id": "oc://openclaw.config/models/providers/openai/apiKey",
        "kind": "input",
        "source": "oc://openclaw.config/models/providers/openai/apiKey",
        "provenance": "secretRef",
        "refSource": "env",
        "refProvider": "vault"
      }
    ],
    "authProfiles": [
      {
        "id": "github",
        "source": "oc://openclaw.config/auth/profiles/github",
        "validMetadata": true,
        "provider": "github",
        "mode": "token"
      }
    ],
    "tools": [
      {
        "id": "deploy",
        "source": "oc://TOOLS.md/tools/deploy",
        "line": 12,
        "risk": "critical",
        "sensitivity": "restricted",
        "capabilities": ["IRREVERSIBLE_EXTERNAL"]
      }
    ]
  },
  "checksRun": 30,
  "checksSkipped": 0,
  "findings": []
}

openclaw policy watch --json

Findings

Check id	Finding
`policy/policy-jsonc-missing`	Policy is enabled but `policy.jsonc` is missing.
`policy/policy-jsonc-invalid`	Policy cannot be parsed or contains malformed rule entries.
`policy/policy-hash-mismatch`	Policy does not match configured `expectedHash`.
`policy/attestation-hash-mismatch`	Current policy evidence no longer matches the accepted attestation.
`policy/policy-conformance-invalid`	A baseline or checked policy file has invalid comparison syntax.
`policy/policy-conformance-missing`	A checked policy file is missing a rule required by the baseline policy file.
`policy/policy-conformance-weaker`	A checked policy file has a weaker value than the baseline policy file.
`policy/channels-denied-provider`	An enabled channel matches a channel deny rule.
`policy/mcp-denied-server`	A configured MCP server is denied by policy.
`policy/mcp-unapproved-server`	A configured MCP server is outside the allowlist.
`policy/models-denied-provider`	A configured model provider or model ref uses a denied provider.
`policy/models-unapproved-provider`	A configured model provider or model ref is outside the allowlist.
`policy/network-private-access-enabled`	A private-network SSRF escape hatch is enabled when policy denies it.
`policy/routing-bindings-required`	Policy requires a channel route binding, but none is configured.
`policy/routing-binding-channel-unconfigured`	A route binding names a channel absent from `channels.*`.
`policy/routing-agent-mismatch`	An authored route resolves to a different agent.
`policy/routing-match-kind-mismatch`	An authored route matches at an unexpected binding specificity.
`policy/ingress-dm-policy-unapproved`	A channel DM policy is outside the policy allowlist.
`policy/ingress-dm-scope-unapproved`	`session.dmScope` does not match the policy-required DM isolation scope.
`policy/ingress-open-groups-denied`	A channel group policy is `open` while policy denies open group ingress.
`policy/ingress-group-mention-required`	A channel or group entry disables mention gates while policy requires them.
`policy/gateway-non-loopback-bind`	Gateway bind posture permits non-loopback exposure when policy denies it.
`policy/gateway-auth-disabled`	Gateway authentication is disabled when policy requires auth.
`policy/gateway-rate-limit-missing`	Gateway auth rate-limit posture is not explicit when policy requires it.
`policy/gateway-control-ui-insecure`	Gateway Control UI insecure exposure toggles are enabled.
`policy/gateway-tailscale-funnel`	Gateway Tailscale Funnel exposure is enabled when policy denies it.
`policy/gateway-remote-enabled`	Gateway remote mode is active when policy denies it.
`policy/gateway-http-endpoint-enabled`	A Gateway HTTP API endpoint is enabled while denied by policy.
`policy/gateway-http-url-fetch-unrestricted`	Gateway HTTP URL-fetch input lacks a required URL allowlist.
`policy/gateway-node-command-denied`	A node command denied by policy is not denied by OpenClaw config.
`policy/agents-workspace-access-denied`	Agent sandbox mode or workspace access is outside the policy allowlist.
`policy/agents-tool-not-denied`	An agent or default config does not deny a tool required by policy.
`policy/tools-profile-unapproved`	A configured global or per-agent tool profile is outside the allowlist.
`policy/tools-fs-workspace-only-required`	Filesystem tools are not configured with workspace-only path posture.
`policy/tools-exec-security-unapproved`	Exec security mode is outside the policy allowlist.
`policy/tools-exec-ask-unapproved`	Exec ask mode is outside the policy allowlist.
`policy/tools-exec-host-unapproved`	Exec host routing is outside the policy allowlist.
`policy/tools-elevated-enabled`	Elevated tool mode is enabled when policy denies it.
`policy/tools-also-allow-missing`	A configured `alsoAllow` list is missing an entry required by policy.
`policy/tools-also-allow-unexpected`	A configured `alsoAllow` list includes an entry not expected by policy.
`policy/tools-required-deny-missing`	A global or per-agent tool deny list does not include a required denied tool.
`policy/sandbox-mode-unapproved`	Sandbox mode is outside the policy allowlist.
`policy/sandbox-backend-unapproved`	Sandbox backend is outside the policy allowlist.
`policy/sandbox-container-posture-unobservable`	A container posture rule is enabled for a backend that cannot observe it.
`policy/sandbox-container-host-network-denied`	A container-backed sandbox or browser uses host network mode.
`policy/sandbox-container-namespace-join-denied`	A container-backed sandbox or browser joins another container namespace.
`policy/sandbox-container-mount-mode-required`	A container-backed sandbox or browser mount is not read-only.
`policy/sandbox-container-runtime-socket-mount`	A container-backed sandbox or browser mount exposes the container runtime socket.
`policy/sandbox-container-unconfined-profile`	Container sandbox profile is unconfined when policy denies it.
`policy/sandbox-browser-cdp-source-range-missing`	Sandbox browser CDP source range is missing when policy requires one.
`policy/data-handling-redaction-disabled`	Sensitive logging redaction is disabled when policy requires it.
`policy/data-handling-telemetry-content-capture`	Telemetry content capture is enabled when policy denies it.
`policy/data-handling-session-retention-not-enforced`	Session retention maintenance is not enforced when policy requires it.
`policy/data-handling-session-transcript-memory-enabled`	Session transcript memory indexing is enabled when policy denies it.
`policy/secrets-unmanaged-provider`	A config SecretRef references a provider not declared under `secrets.providers`.
`policy/secrets-denied-provider-source`	A config secret provider or SecretRef uses a source denied by policy.
`policy/secrets-insecure-provider`	A secret provider opts into insecure posture when policy denies it.
`policy/auth-profile-invalid-metadata`	A config auth profile is missing valid provider or mode metadata.
`policy/auth-profile-unapproved-mode`	A config auth profile mode is outside the policy allowlist.
`policy/exec-approvals-missing`	Policy requires `exec-approvals.json`, but the artifact is missing.
`policy/exec-approvals-invalid`	The configured exec approvals artifact cannot be parsed.
`policy/exec-approvals-default-security-unapproved`	Exec approval defaults use a security mode outside the policy allowlist.
`policy/exec-approvals-agent-security-unapproved`	A per-agent effective exec approval security mode is outside the allowlist.
`policy/exec-approvals-auto-allow-skills-enabled`	An exec approval agent implicitly auto-allows skill CLIs when policy denies it.
`policy/exec-approvals-allowlist-missing`	The approvals allowlist is missing a pattern required by policy.
`policy/exec-approvals-allowlist-unexpected`	The approvals allowlist includes a pattern not expected by policy.
`policy/tools-missing-risk-level`	A governed tool declaration is missing risk metadata.
`policy/tools-unknown-risk-level`	A governed tool declaration uses an unknown risk value.
`policy/tools-missing-sensitivity-token`	A governed tool declaration is missing sensitivity metadata.
`policy/tools-missing-owner`	A governed tool declaration is missing owner metadata.
`policy/tools-unknown-sensitivity-token`	A governed tool declaration uses an unknown sensitivity value.

{
  "checkId": "policy/channels-denied-provider",
  "severity": "error",
  "message": "Channel 'telegram' uses denied provider 'telegram'.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/channels/telegram",
  "target": "oc://openclaw.config/channels/telegram",
  "requirement": "oc://policy.jsonc/channels/denyRules/#0",
  "fixHint": "Telegram is not approved for this workspace."
}

{
  "checkId": "policy/tools-missing-risk-level",
  "severity": "error",
  "message": "TOOLS.md tool 'deploy' has no explicit risk classification.",
  "source": "policy",
  "path": "TOOLS.md",
  "line": 12,
  "ocPath": "oc://TOOLS.md/tools/deploy",
  "target": "oc://TOOLS.md/tools/deploy",
  "requirement": "oc://policy.jsonc/tools/requireMetadata"
}

{
  "checkId": "policy/mcp-unapproved-server",
  "severity": "error",
  "message": "MCP server 'remote' is not in the policy allowlist.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/mcp/servers/remote",
  "target": "oc://openclaw.config/mcp/servers/remote",
  "requirement": "oc://policy.jsonc/mcp/servers/allow"
}

{
  "checkId": "policy/models-unapproved-provider",
  "severity": "error",
  "message": "Model ref 'anthropic/claude-sonnet-4.7' uses unapproved provider 'anthropic'.",
  "source": "policy",
  "path": "openclaw config",
  "ocPath": "oc://openclaw.config/agents/defaults/model/fallbacks/#0",
  "target": "oc://openclaw.config/agents/defaults/model/fallbacks/#0",
  "requirement": "oc://policy.jsonc/models/providers/allow"
}

Repair

doctor --lint and policy check are read-only.

주요 항목:

set tools.elevated.enabled=false when a global policy forbids elevated tools
add missing required-deny tool ids to tools.deny or
set insecure gateway.controlUi.* toggles to false
set gateway.mode=local when policy denies remote gateway mode
set reported gateway.http.endpoints.*.enabled paths to false when policy
set reported channel ingress groupPolicy paths to allowlist when policy
set reported channel ingress requireMention paths to true when policy
set logging.redactSensitive=tools when policy requires sensitive logging
set diagnostics.otel.captureContent=false, or

{
  "plugins": {
    "entries": {
      "policy": {
        "config": {
          "workspaceRepairs": true,
        },
      },
    },
  },
}

Exit codes

Command	`0`	`1`	`2`
`policy check`	No findings at the threshold.	One or more findings met the threshold.	Argument or runtime failure.
`policy compare`	The policy file is at least as strict as the baseline.	The policy file is invalid, missing, or weaker than baseline rules.	Argument or runtime failure.
`policy watch`	No findings and accepted hash is current.	Findings exist or accepted attestation is stale.	Argument or runtime failure.

실습 체크리스트

공식 문서와 로컬 버전을 대조합니다: https://docs.openclaw.ai/cli/policy
관련 CLI는 openclaw --help 및 하위 명령 --help로 옵션을 확인합니다.
설정 변경 시 openclaw config / openclaw doctor로 유효성을 검사합니다.
Gateway·채널·플러그인 변경 후에는 필요 시 Gateway를 재시작합니다.

자주 쓰는 명령·설정 예시

openclaw plugins enable policy

{
  "channels": {
    "denyRules": [
      {
        "id": "no-telegram",
        "when": { "provider": "telegram" },
        "reason": "Telegram is not approved for this workspace.",
      },
    ],
  },
  "mcp": {
    "servers": {
      "allow": ["docs"],
      "deny": ["untrusted"],
    },
  },
  "models": {
    "providers": {
      "allow": ["openai", "anthropic"],
      "deny": ["openrouter"],
    },
  },
  "network": {
    "privateNetwork": {
      "allow": false,
    },
  },
  "routing": {
    "requireBindings": true,
    "requireConfiguredChannels": true,
    "probes": [
      {
        "id": "family-dm",
        "route": {
          "channel": "imessage",
          "peer": { "kind": "direct", "id": "+15555550123" },
        },
        "expect": {
          "agentId": "family",
          "matchedBy": ["binding.peer"],
        },
      },
    ],
  },
  "ingress": {
    "session": {
      "requireDmScope": "per-channel-peer",
    },
    "channels": {
      "allowDmPolicies": ["pairing", "allowlist", "disabled"],
      "denyOpenGroups": true,
      "requireMentionInGroups": true,
    },
  },
  "gateway": {
    "exposure": {
      "allowNonLoopbackBind": false,
      "allowTailscaleFunnel": false,
    },
    "auth": {
      "requireAuth": true,
      "requireExplicitRateLimit": true,
    },
    "controlUi": {
      "allowInsecure": false,
    },
    "remote": {
      "allow": false,
    },
    "http": {
      "denyEndpoints": ["chatCompletions", "responses"],
      "requireUrlAllowlists": true,
    },
    "nodes": {
      "denyCommands": ["system.run"],
    },
  },
  "agents": {
    "workspace": {
      "allowedAccess": ["none", "ro"],
      "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
    },
  },
  "dataHandling": {
    "sensitiveLogging": {
      "requireRedaction": true,
    },
    "telemetry": {
      "denyContentCapture": true,
    },
    "retention": {
      "requireSessionMaintenance": true,
    },
    "memory": {
      "denySessionTranscriptIndexing": true,
    },
  },
  "secrets": {
    "requireManagedProviders": true,
    "denySources": ["exec"],
    "allowInsecureProviders": false,
  },
  "auth": {
    "profiles": {
      "requireMetadata": ["provider", "mode"],
      "allowModes": ["api_key", "token"],
    },
  },
  "execApprovals": {
    "requireFile": true,
    "defaults": { "allowSecurity": ["deny"] },
    "agents": {
      "allowSecurity": ["deny", "allowlist"],
      "allowAutoAllowSkills": false,
      "allowlist": { "expected": ["deploy", "status"] },
    },
  },
  "tools": {
    "requireMetadata": ["risk", "sensitivity", "owner"],
    "profiles": {
      "allow": ["messaging", "minimal"],
    },
    "fs": {
      "requireWorkspaceOnly": true,
    },
    "exec": {
      "allowSecurity": ["deny", "allowlist"],
      "requireAsk": ["always"],
      "allowHosts": ["sandbox"],
    },
    "elevated": {
      "allow": false,
    },
    "denyTools": ["group:runtime", "group:fs"],
  },
}

{
  "tools": {
    "exec": {
      "allowHosts": ["sandbox", "node"],
    },
  },
  "sandbox": {
    "requireMode": ["all", "non-main"],
  },
  "scopes": {
    "release-workspace": {
      "agentIds": ["release-agent", "review-agent"],
      "agents": {
        "workspace": {
          "allowedAccess": ["none", "ro"],
        },
      },
    },
    "release-lockdown": {
      "agentIds": ["release-agent"],
      "tools": {
        "exec": {
          "allowHosts": ["sandbox"],
          "allowSecurity": ["deny", "allowlist"],
          "requireAsk": ["always"],
        },
        "denyTools": ["exec", "process", "write", "edit", "apply_patch"],
      },
      "sandbox": {
        "requireMode": ["all"],
        "allowBackends": ["docker"],
      },
      "dataHandling": {
        "memory": {
          "denySessionTranscriptIndexing": true,
        },
      },
    },
    "shell-sandbox": {
      "agentIds": ["shell-agent"],
      "sandbox": {
        "allowBackends": ["openshell"],
        "containers": {
          "requireReadOnlyMounts": false,
        },
      },
    },
    "telegram-ingress": {
      "channelIds": ["telegram"],
      "ingress": {
        "channels": {
          "allowDmPolicies": ["pairing"],
          "denyOpenGroups": true,
          "requireMentionInGroups": true,
        },
      },
    },
  },
}

{
  "execApprovals": {
    "requireFile": true,
    "defaults": {
      // Security modes: "deny", "allowlist", or "full".
      // This default permits only the locked-down deny posture.
      "allowSecurity": ["deny"],
    },
  },
  "scopes": {
    "restricted-shell": {
      "agentIds": ["family-agent", "groups-agent"],
      "execApprovals": {
        "agents": {
          // Selected agents may use reviewed allowlist posture, but not "full".
          "allowSecurity": ["allowlist"],
          // false means skill CLIs must appear in the reviewed allowlist instead of
          // being implicitly approved by autoAllowSkills.
          "allowAutoAllowSkills": false,
          "allowlist": {
            "expected": [
              // Simple entry: exact reviewed executable pattern with no argPattern.
              "travel-hub",
              // Constrained entry: pattern plus reviewed argument regex.
              { "pattern": "calendar-cli", "argPattern": "^sync\\b" },
              "/bin/date",
            ],
          },
        },
      },
    },
  },
}

openclaw policy check
openclaw policy check --json
openclaw policy check --severity-min error

openclaw policy compare --baseline official.policy.jsonc
openclaw policy compare --baseline official.policy.jsonc --policy policy.jsonc --json

Policy

핵심 요약

문서 구성

상세 내용

openclaw policy

빠른 시작

Policy rule reference

Run checks

Configure policy

Accept policy state

Findings

Repair

Exit codes

관련 문서

실습 체크리스트

자주 쓰는 명령·설정 예시

관련 링크

관련 가이드

Policy

핵심 요약

문서 구성

상세 내용

openclaw policy

빠른 시작

Policy rule reference

Run checks

Configure policy

Accept policy state

Findings

Repair

Exit codes

관련 문서

실습 체크리스트

자주 쓰는 명령·설정 예시

관련 링크

관련 가이드