governance-policies

name	governance-policies
description	Set up governance policies for OpenClaw — block dangerous commands, detect PII, prevent data exfiltration, protect agent config files. Use when hardening an OpenClaw deployment with AxonFlow.
homepage	https://github.com/getaxonflow/axonflow-openclaw-plugin/tree/main/policies
tags	security, governance, pii, compliance, openclaw, audit

AxonFlow Governance Policies for OpenClaw

Use when setting up or hardening an OpenClaw deployment with AxonFlow governance. This skill covers self-hosting AxonFlow, plugin installation, policy configuration, and risk mitigation.

Self-Host AxonFlow

Prerequisites

• Docker Engine or Docker Desktop
• Docker Compose v2
• 4 GB RAM minimum, 10 GB free disk
• No LLM provider keys required — OpenClaw handles all LLM calls, AxonFlow only enforces policies and records audit trails

Start AxonFlow

git clone https://github.com/getaxonflow/axonflow.git
cd axonflow
cp .env.example .env
docker compose up -d

Verify

# Check services are running
docker compose ps

# Health check
curl -s http://localhost:8080/health | jq .

Services

Service	Port	Purpose
Agent	8080	Main API — all requests go here
Orchestrator	8081	Internal — do not call directly
PostgreSQL	5432	Policy storage
Redis	6379	Coordination
Prometheus	9090	Metrics
Grafana	3000	Dashboards

All SDK and plugin traffic goes through the Agent on port 8080. Never call the Orchestrator directly.

Install the Plugin

openclaw plugins install @axonflow/openclaw

Configure in your OpenClaw config:

plugins:
  @axonflow/openclaw:
    endpoint: http://localhost:8080
    clientId: your-client-id
    clientSecret: your-secret
    highRiskTools:
      - exec
      - process
      - browser
      - web_fetch
      - message
    onError: block

onError: block means tool calls are blocked if AxonFlow is unreachable. Use allow only in development.

In community mode (DEPLOYMENT_MODE=community), client auth checks are skipped for the local developer flow, so any clientId/clientSecret pair works.

What's Protected Automatically

AxonFlow's built-in system policies apply with no additional setup:

• PII: SSN, credit card, email, phone, Aadhaar, PAN
• SQL injection: built-in detection patterns
• Dangerous commands: destructive operations, privilege escalation
• Secrets: API keys, connection strings, code secrets

OpenClaw-Specific Hardening Policies

Add these for protection against OpenClaw-specific attack vectors.

Block Reverse Shells and Destructive Commands

INSERT INTO static_policies (name, category, pattern, severity, action_request, action_response, description)
VALUES
  ('openclaw_block_reverse_shells', 'security_dangerous', '(nc\s+-e|bash\s+-i|/dev/tcp/|python\s+-c.*socket|curl\s+.*\|\s*sh|wget\s+.*\|\s*sh|base64\s+.*-d\s+.*\|\s*sh)', 'critical', 'block', 'allow', 'Block reverse shell and remote code execution patterns'),
  ('openclaw_block_destructive_fs', 'security_dangerous', '(rm\s+-rf\s+/|rm\s+-rf\s+~|dd\s+if=|mkfs\b|>\s*/dev/sd|chmod\s+-R\s+777\s+/)', 'critical', 'block', 'allow', 'Block destructive filesystem operations'),
  ('openclaw_block_credential_access', 'security_dangerous', '(cat\s+.*\.ssh/|cat\s+.*\.aws/|cat\s+.*\.env\b|cat\s+.*\.netrc|cat\s+.*\.gnupg/|printenv\s+.*KEY|printenv\s+.*SECRET|printenv\s+.*TOKEN)', 'high', 'block', 'allow', 'Block credential file and environment variable access');

Block Data Exfiltration (SSRF)

INSERT INTO static_policies (name, category, pattern, severity, action_request, action_response, description)
VALUES
  ('openclaw_block_metadata_endpoints', 'security_dangerous', '(169\.254\.169\.254|metadata\.google|metadata\.aws)', 'critical', 'block', 'allow', 'Block cloud metadata endpoint access'),
  ('openclaw_block_internal_networks', 'security_dangerous', '(localhost|127\.0\.0\.1|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.)', 'high', 'block', 'allow', 'Block requests to internal/private network addresses');

Protect Agent Config Files

Block writes to OpenClaw's persistent context files to prevent memory poisoning:

INSERT INTO static_policies (name, category, pattern, severity, action_request, action_response, description)
VALUES
  ('openclaw_protect_agent_config', 'security_dangerous', '(SOUL\.md|MEMORY\.md|IDENTITY\.md|AGENTS\.md|openclaw\.json|auth-profiles\.json)', 'high', 'block', 'allow', 'Block modification of OpenClaw agent identity and memory files');

Block Path Traversal

Prevent workspace escape (CVE-2026-33573 pattern):

INSERT INTO static_policies (name, category, pattern, severity, action_request, action_response, description)
VALUES
  ('openclaw_block_path_traversal', 'security_dangerous', '(\.\./|/etc/passwd|/etc/shadow|/proc/self)', 'high', 'block', 'allow', 'Block path traversal and sensitive system file access');

Top 10 Risks

Rank	Risk	Hook
1	Arbitrary command execution	before_tool_call
2	Data exfiltration via HTTP	before_tool_call
3	PII leakage in messages	message_sending
4	Indirect prompt injection	before_tool_call
5	Outbound secret exfiltration	message_sending
6	Malicious skill supply chain	after_tool_call (audit)
7	Memory/context poisoning	before_tool_call
8	Credential exposure	message_sending
9	Cross-tenant leakage	Tenant-scoped policies
10	Workspace boundary bypass	before_tool_call

Guardrails

• All policies are evaluated server-side by AxonFlow, not locally.
• highRiskTools require human approval only after AxonFlow allows the tool call. If AxonFlow blocks the tool, it stays blocked.
• The plugin verifies AxonFlow connectivity on startup.
• Tool result transcript scanning is pending async hook support in OpenClaw (openclaw#58558).

Learn More

Get Started

• Getting Started — quickstart for new users
• OpenClaw Integration Guide — full plugin setup walkthrough
• Self-Hosted Deployment — Docker Compose, prerequisites, production options

Policies & Security

• Security Best Practices — hardening guide for production deployments
• Policy Enforcement — how policies are evaluated at runtime
• Policy Syntax — writing custom regex and rule-based policies
• System Policies — 83 built-in policies (PII, SQLi, secrets, dangerous commands)
• PII Detection — SSN, credit card, Aadhaar, PAN, email, phone detection and redaction
• Response Redaction — how outbound content is scanned and redacted

Governance & Compliance

• Audit Logging — compliance-grade audit trails for every tool call and LLM interaction
• Human-in-the-Loop — approval gates for high-risk operations
• HITL Approval Gates — configuring approval workflows
• Cost Management — token budgets, rate limits, cost controls
• Compliance Frameworks — EU AI Act, MAS FEAT, RBI, SEBI templates

Platform & Examples

• Feature Overview — full platform capabilities
• Community vs Enterprise — what's available in each tier
• Workflow Examples — multi-step governance workflows and advanced patterns
• Banking Example — financial services governance patterns
• Healthcare Example — HIPAA-aware agent governance
• E-commerce Example — customer-facing agent policies

Source Code

• Plugin Source — MIT licensed
• AxonFlow Community — source-available under BSL 1.1

Licensing

• AxonFlow platform (getaxonflow/axonflow): BSL 1.1 (Business Source License). Source-available, not open source.
• @axonflow/openclaw plugin (getaxonflow/axonflow-openclaw-plugin): MIT. Free to use, modify, and redistribute.
• This uploaded ClawHub skill bundle: MIT-0 per ClawHub terms.