How to govern OpenClaw
An open-source assistant staff install on their own devices, with shell, file, browser and chat access and no vendor behind it.
OpenClaw Foundation · Reviewed quarterly, and when the project ships a capability change or a customer declares the tool · Last reviewed 16 Oct 2026
No governance change Reviewed the releases page and the project's README and docs. The stable release of 13 October is maintenance; a 15 October pre-release adds cloud sessions, MCP apps and automations, and a PostgreSQL store. The tool page was rewritten to describe what the project says it is: a self-hosted assistant staff install on their own devices, with shell, file, browser and messaging access. The recorded defaults already treat it as an autonomous agent that changes records. Full changelog ↓How OpenClaw is used
We see two common ways businesses use OpenClaw, and we govern each one on its own terms. If your team uses it differently, that is fine: you describe the use in your own words and Certrak works out the governance from what it actually does.
Autonomous task agent
Consequence to people: HighGeneral-purpose AI agent that takes actions across your tools and systems - email, calendar, messaging, files
Workflow automation across systems
Consequence to people: MediumAutomating tasks across business systems - triggers, data movement, decisions in workflows
Governing OpenClaw in practice
- Name one person who owns OpenClaw in your business. Governance starts with a name.
- Write down what OpenClaw is used for. Certrak recognises 2 common uses: Autonomous task agent and Workflow automation across systems. Yours may differ; write down yours.
- Decide what OpenClaw may and may not be given. Personal information is in scope for some uses; write the boundary down before it is needed.
- There is no human review of outputs. Decide whether that is acceptable for each use, and what would make you change it.
- OpenClaw can create, change, or delete records in another system without a person approving. Record which of these you allow, and who can change that.
- Look at this again every month, and sooner on any of these: industry incidents, vendor model updates, autonomy level changes and data classification changes.
What it is
OpenClaw is an open-source AI assistant that a person installs on their own computer or server and talks to through Discord, iMessage, Slack, Teams, Telegram, WhatsApp and other chat apps. There is no company behind it and no hosted service. The OpenClaw Foundation, an independent non-profit, signs the releases, and the project's own description is that state, memory and credentials live on the hardware it runs on. It started life as Clawdbot, became Moltbot, and took its current name in January 2026.
Why it needs governing
- It runs commands and code on the machine it is installed on unless sandboxing is configured, and it reads and edits files.
- It can send messages on the person's behalf in the connected chat apps, and it can operate a browser, including one that is already signed in.
- It treats messages from unknown senders as untrusted, but a person decides what it can reach, so a loosely configured install exposes whatever that account can reach.
- Because anyone can install it, it tends to arrive as shadow AI: on a staff laptop, under a personal account, with no owner on record.
What to do first
- Find out who has installed it and on which devices. Ask; the installer leaves no central record.
- Record each install as its own system with a named owner, and note which chat apps and folders it is connected to.
- Treat it as an agent that changes records and sends messages, because it can, and confirm that sandboxing and command approvals are switched on.
- Keep it off devices that hold personal or special-category information unless the owner can show the folder scope is limited.
Sources: the project's README and documentation, read 16 October 2026.
Written by Certrak.
What changed, and how Certrak responded
We record every check here, including the ones that changed nothing. A check that found no governance change proves we looked.
-
No governance change Scheduled review
openclaw 2026.10.3
OpenClaw Foundation shipped it 13 Oct 2026.
Reviewed the releases page and the project's README and docs. The stable release of 13 October is maintenance; a 15 October pre-release adds cloud sessions, MCP apps and automations, and a PostgreSQL store. The tool page was rewritten to describe what the project says it is: a self-hosted assistant staff install on their own devices, with shell, file, browser and messaging access. The recorded defaults already treat it as an autonomous agent that changes records.