OpenClaw Language Boundary

Language Boundary is a safety policy plugin for OpenClaw. It turns agent actions into a structured Action IR, classifies risk, writes redacted audits, and blocks or requests approval for high-risk behavior when enforcement is enabled.

中文说明见 README.zh-CN.md.

What it is for

Use this plugin when you want OpenClaw to have a clear action boundary instead of relying only on model self-discipline.

It helps answer these questions before a tool call runs:

• Is this action read-only, workspace-mutating, system-mutating, external, or destructive?
• Does it target config, credentials, memory, local files, production data, or an external service?
• Should it be allowed, logged, require approval, require strong approval, or be denied?
• Can the audit trail be useful without leaking private local details?

Philosophy

Language Boundary is based on a simple idea:

Agents should not get safer by becoming more timid. They should get safer by having explicit, inspectable boundaries.

The plugin separates three layers:

1. Understanding — build a conservative Action IR from the tool name and parameters.
2. Policy — apply config-driven rules to risk, target, and effect.
3. Rollout — move from observation to enforcement only when audit data is clean.

It is not a replacement for user judgment. It is a runtime guardrail that makes risky actions visible and enforceable.

What it can do

• Classify tool calls by effect, target, and risk.
• Detect unknown tools.
• Detect dangerous shell commands and local destructive actions.
• Protect config and credential paths with strong approval.
• Treat external writes, outbound messages, installs, subagent spawning, and cron changes as policy-controlled events.
• Redact sensitive-looking audit fields.
• Track tool failure state and summarize noisy tools.
• Show an operator-facing status card.
• Support progressive hardening phases:
  • observe
  • guided
  • strict
  • force

What it records locally

Language Boundary is a local safety/audit plugin. When enabled, it may write local audit and state records under the user's OpenClaw profile directory. These records are meant to help operators understand why a tool call was allowed, logged, blocked, or escalated.

Typical local records may include:

• tool names, action categories, risk decisions, and redacted parameters;
• session/run/channel/sender identifiers when OpenClaw exposes them to the hook;
• target path/service metadata and content hashes used for auditability;
• recent source-ledger entries used to summarize source authority in later prompt context.

It does not upload these records. They stay local unless the user backs up, syncs, or shares the OpenClaw profile. Redaction is enabled by default, but redaction is conservative rather than perfect; users working in highly sensitive environments should review or override audit and state paths, disable audit if necessary, and start in observe mode before enforcement.

Install

openclaw plugins install clawhub:openclaw-language-boundary@0.1.7
openclaw gateway restart

For the latest ClawHub release:

openclaw plugins install clawhub:openclaw-language-boundary
openclaw gateway restart

Recommended first configuration

Start in observe unless you already know your environment and want enforcement immediately.

{
  "plugins": {
    "entries": {
      "language-boundary": {
        "enabled": true,
        "config": {
          "enabled": true,
          "mode": "observe",
          "hardening": {
            "enabled": true,
            "phase": "observe",
            "autoAdvance": "off"
          },
          "audit": {
            "enabled": true,
            "redact": true
          }
        }
      }
    }
  }
}

After installation, check status:

cd ~/.openclaw/extensions/language-boundary
npm run status-card

Progressive hardening

Recommended path:

1. Start with observe.
2. Review status card and audit samples.
3. Move to guided after a clean window.
4. Move to strict or force only deliberately.

The plugin supports autoAdvance: "guided-only", but it never auto-enters strict or force.

Force-mode coverage

The release gate includes E2E-style coverage for:

• high-risk shell approval
• external writes
• config protection
• outbound secret redaction
• cron-change auditing

Useful commands from source or installed package

npm run status-card
npm run status-card -- --json
npm run init-config -- --mode=observe
npm run init-config -- --mode=guided
npm run init-config -- --mode=strict
npm run init-config -- --mode=force
npm run release:check

Reusability rules

This plugin is meant for other OpenClaw users, not one private machine.

• Use placeholders such as <USER_HOME>, <WORKSPACE>, and <PROJECT_ROOT> in docs and tests.
• Do not hard-code personal home directories, usernames, machine names, channel IDs, provider accounts, credentials, or local cron jobs.
• Keep path classification config-driven.
• Keep audit and state paths configurable or derived from the user's OpenClaw/home directory.

Current release

• Latest verified release: openclaw-language-boundary@0.1.7
• ClawHub release ID: rd76343ffq102yy5zk7kh6ybzn888aym
• Status at final verification: published, scanned clean, isolated install verified.