@@ -18,39 +18,6 @@ Adds policy-backed doctor checks for workspace conformance.
1818
1919plugin
2020
21- ## Behavior
22-
23- The Policy plugin contributes doctor health checks for policy-managed OpenClaw
24- settings and governed workspace declarations. Policy currently covers channel
25- conformance, governed tool metadata, MCP server posture, model-provider posture,
26- private-network access posture, Gateway exposure posture, agent workspace/tool
27- posture, configured global/per-agent tool posture, and OpenClaw config secret
28- provider/auth profile posture.
29-
30- Policy stores authored requirements in ` policy.jsonc ` , observes existing
31- OpenClaw settings and workspace declarations as evidence, and reports drift
32- through ` openclaw policy check ` and ` openclaw doctor --lint ` . A clean policy
33- check emits policy, evidence, findings, and attestation hashes that operators
34- can record for audit.
35-
36- Tool posture rules can require approved profiles, workspace-only filesystem
37- tools, bounded exec security/ask/host settings, disabled elevated mode, exact
38- ` alsoAllow ` entries, and required tool deny entries. The evidence records
39- additive ` alsoAllow ` entries because they can widen effective tool posture.
40- These checks observe config conformance only; they do not read runtime approval
41- state or add runtime enforcement.
42-
43- Named agent policy scopes under ` scopes.<scopeName> ` can add stricter
44- normal policy sections for the runtime agent ids listed in ` agentIds ` . The
45- initial scoped sections are ` tools ` and ` agents.workspace ` ; future sections such
46- as sandbox or ingress can join the same container after their evidence carries
47- agent identity. Every scope present in ` policy.jsonc ` must be valid and
48- enforceable for its selector. Overlay rules are additional claims, so they do
49- not weaken top-level policy and can produce their own findings when the same
50- observed config violates both scopes. Runtime agent ids that are not explicitly
51- listed in ` agents.list[] ` are checked against inherited global/default posture
52- rather than silently passing with no evidence.
53-
5421## Related docs
5522
5623- [ policy] ( /cli/policy )
0 commit comments