The highest-risk moment is not installation—it is execution
Package review and allowlists decide what may enter a workspace. They cannot prove that every future invocation of an approved capability is appropriate. A legitimate skill can be called with the wrong arguments, by the wrong delegated agent, for a purpose the operator never intended.
The AgenticDome plugin uses OpenClaw’s typed lifecycle hooks to evaluate supported prompts and proposed tool calls at runtime. It can stop a denied call before execution and locally redact recognized sensitive values before supported tool results become durable transcript content.
What changes when AgenticDome is in the path
Once the plugin is loaded and the required hook access is enabled, supported OpenClaw prompt, tool, delegation, and persistence events cross an AgenticDome control. The runtime can deny a proposed tool before it runs, verify a protected specialist handoff, and redact recognized sensitive content before supported transcript persistence.
Why OpenClaw operators add AgenticDome
AgenticDome gives workspace owners a second decision after installation: not only “is this capability present?” but “is this exact use justified now?” That distinction matters whenever tools can act with real credentials or host access.
Authorize every supported use
Evaluate the proposed tool and arguments at before_tool_call rather than granting permanent operational trust because a skill was installed.
Verify delegated execution
Require protected manager-to-specialist work to match the intended source, target, session, tool, and arguments before the specialist acts.
Keep transcripts safer
Use synchronous local redaction in the persistence hook so recognized credentials and identifiers are handled before supported tool results are saved.
Join the wider policy plane
Govern OpenClaw alongside supported Python, TypeScript, MCP, and cloud-agent workloads instead of creating a separate security vocabulary for one workspace.
A native plugin path, not a replacement runtime
Install the npm plugin, enable it through the OpenClaw CLI, grant only the hook access the deployment requires, restart the Gateway, and confirm the expected hooks are loaded. Keep OpenClaw installPolicy, tool policy, sandboxing, egress controls, and host hardening in force.
How AgenticDome creates the control point
1. Agent run
Screen supported conversation context when the operator has granted access.
2. Tool or skill
Authorize the proposed name and arguments in before_tool_call before invocation.
3. Delegation
Authorize recognized manager-to-specialist patterns and verify protected specialist execution.
4. Tool result
Perform synchronous local no-network redaction before transcript persistence.
5. Explicit skill wrapper
Use protectedExecute() or sanitizeOutput() for cloud-backed review inside custom skills.
What this changes for real teams
Installed skills still answer to policy
“We use community and internal skills, but installation approval should not become a permanent blank cheque.”
AgenticDome contribution: The before_tool_call hook evaluates supported calls at use time. OpenClaw installPolicy, package review, pinning, and allowlists continue to decide what enters the workspace.
Sensitive results do not belong in transcripts
“A credential returned during a successful tool call should not become durable conversation history.”
AgenticDome contribution: tool_result_persist performs local synchronous redaction before supported persistence. Custom skills can additionally call async tenant-policy output review where their execution path permits it.
Internal handoffs are not implicit authority
“A specialist should execute only the action that the manager was allowed to delegate.”
AgenticDome contribution: Documented delegation paths use short-lived decision state and specialist verification bound to the matching action context. Custom handoff formats remain explicit integration work.
The risks this helps contain
| Risk | Why it matters | Public AgenticDome control |
|---|---|---|
| Unsafe installed capability | A plugin or skill can expose actions with filesystem, process, network, or service access. | Authorize supported calls at before_tool_call and retain OpenClaw tool policy, installPolicy, package review, and least privilege. |
| Credential misuse with valid access | A technically valid token does not prove the requested business action is intended. | Evaluate action context independently of credential validity; keep OAuth scopes and server authorization. |
| Transcript disclosure | Tool output may be persisted and reviewed later. | Use local synchronous redaction in tool_result_persist; use explicit async DLP where tenant-policy review is required. |
| Delegation confusion | A specialist may trust an internal request without confirming the exact tool and arguments. | Use documented authorization and specialist verification with shared state for multi-process deployments. |
| Hook not active | A package can be installed while a required hook is disabled, unconsented, or not loaded. | Inspect plugin status after restart and exercise real allowed/blocked test calls before claiming coverage. |
A practical path to production
Verify plugin load
Install, enable, restart, and confirm the expected runtime hooks are registered.
Grant minimum access
Enable conversation access only when prompt screening requires it and document that choice.
Keep supply-chain controls
Use install policy, allowlists, version review, provenance, and safe update practices.
Constrain the host
Limit tool filesystem, process, network, secrets, and credential access independently.
Where this control ends
The plugin covers documented OpenClaw hook and explicit SDK paths that are loaded and configured. Local transcript redaction is intentionally no-network and is not identical to tenant-policy DLP. AgenticDome does not certify a skill, replace OpenClaw installPolicy or tool policy, inspect arbitrary code execution, remove the need for sandboxing, or protect calls that bypass the plugin.
Current lifecycle note
OpenClaw’s plugin and hook contracts evolve. Validate the installed OpenClaw version against the package’s tested range and run the plugin hook smoke test after every runtime or plugin upgrade.