An assistant connected to files, messages and business tools can do useful work. Those connections also determine what a mistake or malicious instruction could affect. Access design belongs at the beginning of the workflow.
- 01Draw the boundary
- 02Treat retrieved material as untrusted
- 03Protect the operational record
- 04Prepare recovery
- 05Review the live configuration
Draw the boundary
List what the agent may read, change and send. Distinguish a local draft from a published change and a retrieved message from permission to reply. Each action should have a reason tied to the task.
Use separate, narrowly scoped credentials where the platform supports them. Avoid handing over a broad personal account simply because it is the fastest way to make a demo work.
Treat retrieved material as untrusted
A webpage, document or incoming message can contain instructions that are unrelated to the user's request. The workflow needs to preserve the distinction between content being processed and authority to act.
Do not assume a single prompt or filter completely solves that problem. Limit the actions available, preserve review boundaries and use the isolation features appropriate to the environment.
Protect the operational record
Keep secrets out of source code and routine logs. Record enough action history to investigate an issue without collecting unnecessary sensitive content. Define who can inspect that record and how long it is retained.
Prepare recovery
Know how to revoke access, stop a run and restore affected state where possible. Test those steps before relying on them during an incident. Some actions, such as sending a message, cannot simply be undone.
Review the live configuration
Security guidance changes as tools evolve. Use the current documentation for the actual deployment, including OpenClaw's security guidance when using that platform. This map is a starting framework, not a claim that an agent is secure because five boxes have been ticked.