Approval modes
Host policy determines when tool calls execute, pause for consent, or are rejected.
Security model
The model proposes. The host decides.
PersonalClaw assumes agents will request powerful actions. It keeps enforceable policy in deterministic host code, outside the model and outside spawned agent runtimes.
Inspect the controlsOwnerYou approve the boundary
Trusted hostGateway · policy · stateDeterministic enforcement
Untrusted requestsModels · tools · appsBounded capabilities
Defense in depth
Controls that do not depend on good prompting.
Each layer addresses a different path from agent intent to host effect. No single toggle carries the whole security story.
Command denylist
Known-destructive shell patterns are blocked even when a model asks confidently.
Guarded egress
Network access passes through allow and deny host policy instead of ambient fetch.
Scoped app tokens
Apps call the gateway with bounded credentials rather than receiving broad authority.
Scanner gate
Apps enter quarantine first. A dangerous verdict cannot be overridden into activation.
Tamper-evident log
HMAC-linked security events make alteration visible during later review.
A tool request
Every effect crosses the gate.
The decision path stays explicit whether the request came from native chat, an autonomous loop, or an ACP coding agent.
- RequestAgent asks to use a tool
- PolicyHost evaluates mode and rules
- ConsentOwner reviews when required
- EffectBounded action executes
- RecordSecurity event is linked
Supply chain
An app is code, not a collectible.
PersonalClaw treats installation as a staged trust decision. The package stays separate until inspection and consent are complete.
QuarantineInactive package boundary
ScanRisk verdict and static checks
ConsentDeclared capabilities shown to owner
Scoped enablementGateway-issued access
Clear limits
Security claims should name their boundary.
PersonalClaw publishes a full threat model — five trust boundaries, an OWASP Agentic Top-10 mapping where every enforced claim cites the module that enforces it, and an honest statement of what is deliberately out of scope. The limitations it can't yet enforce as hard technical boundaries are documented in the code's own words, not softened. It is a pre-1.0 project, so breaking changes and security hardening continue. Review the threat model before relying on it for sensitive, irreplaceable workflows.