The Scalability Bottleneck
Currently, OpenClaw operates as a pure Generator. It relies on the Planner to be both creative and safe. This creates a fragility loop: if the Planner is jailbroken or hallucinates, there is no system-level check to stop it, forcing reliance on manual user approval (which doesn't scale).
The Proposal: The "Discriminator Layer" Pattern
I propose implementing a middleware hook (Gateway.middleware.onToolCall) that adopts the "Council of Critics" pattern from the GATE Framework (gate-framework.org).
This introduces a Discriminator Layer that validates actions before execution using two distinct adversarial checks:
1. The Alignment Critic (Context-Aware)
- Input: User Prompt + Proposed Tool Call.
- Role: "Is this what the user actually asked for?" (Prevents logic bugs/hallucinations).
2. The Blinded Security Critic (The Firewall)
- Input: ONLY the Tool Call (e.g.,
fs.write) + System Policy. (No User Prompt).
- Role: "Is this action safe?"
- Mechanism: Because this agent is isolated from the user's prompt, it is immune to "Ignore previous instructions" jailbreaks. It strictly enforces the policy (e.g., "No shell execution outside /tmp").
Why this enables Scalability
By decoupling "Safety" from the "Planner," we move from "Human-in-the-loop" to "Adversarial-verification-in-the-loop." This allows OpenClaw to run autonomously with high confidence that it won't execute malicious indirect injections.
Implementation
I can provide the prompt templates for the Blinded Security Critic and the architectural patterns for the Discriminator Layer. Looking for a contributor to help implement the middleware hooks.
The Scalability Bottleneck
Currently, OpenClaw operates as a pure Generator. It relies on the Planner to be both creative and safe. This creates a fragility loop: if the Planner is jailbroken or hallucinates, there is no system-level check to stop it, forcing reliance on manual user approval (which doesn't scale).
The Proposal: The "Discriminator Layer" Pattern
I propose implementing a middleware hook (
Gateway.middleware.onToolCall) that adopts the "Council of Critics" pattern from the GATE Framework (gate-framework.org).This introduces a Discriminator Layer that validates actions before execution using two distinct adversarial checks:
1. The Alignment Critic (Context-Aware)
2. The Blinded Security Critic (The Firewall)
fs.write) + System Policy. (No User Prompt).Why this enables Scalability
By decoupling "Safety" from the "Planner," we move from "Human-in-the-loop" to "Adversarial-verification-in-the-loop." This allows OpenClaw to run autonomously with high confidence that it won't execute malicious indirect injections.
Implementation
I can provide the prompt templates for the Blinded Security Critic and the architectural patterns for the Discriminator Layer. Looking for a contributor to help implement the middleware hooks.