Convenience is not least privilege.
OpenClaw documents unsandboxed host execution without approval prompts in its personal-assistant default. Configure a genuine boundary instead. Read the official trust model ↗
XERXES SI / ENGINEERED AGENT CONTROL
CLAWSOLATORTM
AUTONOMY, WITH BOUNDARIES.
DON’T GIVE YOUR AGENTS ROOT.
Give them structure to grow in.
Clawsolator turns powerful agent frameworks into governed environments: guided OpenClaw setup, rootless Podman, domain-separated offices and an independent XMAN policy path for sensitive actions.
The problem is documented: OpenClaw’s personal-assistant defaults trust the host operator. That is not how you separate a law firm, family records, and a production system.
GUIDED INSTALLATIONROOTLESS PODMANPROTECTED ACCESSGOVERNED AGENTS
XERXES / SECURITY COREISOLATE · GOVERN · VERIFY
Motion
THE ENGINEERING CASE / NOT AN ANTI-OPENCLAW RANT01 / DEFAULT AUTHORITY 02 / SANDBOX ≠ GOVERNANCE 03 / ACTUAL CONSEQUENCES
Great agents deserve actual boundaries.
OpenClaw makes agents useful. Its documented trusted-operator defaults are not a complete enterprise separation model. And a sandbox, even an excellent one, is not automatically an approval system, a resource governor, a privacy boundary, or a rollback plan. That's the gap we decided to work on.
Isolation is a layer. Not a management strategy.
NVIDIA OpenShell and NemoClaw offer substantial network, process and filesystem controls. We aim to make the broader work—agent offices, operational budgets, human decisions and repeatable deployment—coherent. Compare approaches ↗
Machines act on authority, not intentions.
Malicious skills and reported unintended inbox actions show why a separate policy path matters. No instruction can undo a privilege already granted. Read sourced case files ↗
Deployment atlas / autonomous systems in context
Meet the agents ↗One platform. Different worlds.
Each world is a distinct deployment example—not a promise that a visual card alone creates a real security boundary.
Executive / Board
Board materials, strategic briefs, advisor workflow, policy-controlled communication.
Explore offices ↗
Law Firm
Matter-level research, confidential documents, reviewable communications and records.
Explore offices ↗
Media & Publishing
Monitor sources, prepare stories, update the website and publish only through approval.
Explore offices ↗
Retail Store
Inventory visibility, customer requests, storefront updates and sales coordination.
Explore offices ↗
Manufacturing / JIT
Monitor factory signals, equipment, just-in-time material flow and production exceptions.
Explore offices ↗
Family & Personal
Personal assistants, schedules, health coordination and private-life boundaries.
Explore offices ↗
IT / Sales
Monitor infrastructure, secure endpoints, testing laboratories and approved sales operations.
Explore offices ↗Agent Atlas / specialist offices
Meet your operators.
Specialists work in bounded offices with distinct tasks, approved inputs, reviewable outputs and enforced policy. New roles below are proposed integration patterns.
MasterStrategy and coordination
ScientistResearch, experimentation and SIDE
ReporterSourced news and intelligence
00 Special AgentControlled testing and validation
SysOpHost, network and service health
SecuritySignals, logs and access anomalies
Legal ResearchCases, citations and matter scoping
FaxApproved document transmission
PhoneCalls and voicemail workflows
EmailTriage, drafts and guarded sending
Website PublisherSite content, review and publishing
Health CoordinatorWellness records, reminders and scheduling
SchedulerAppointments, calendars and follow-ups
Executive AssistantBriefings, correspondence and tasks
SalesLead routing and approved outreach
InventoryStock movement and replenishment
Line MonitorSensor events, maintenance and JIT signals
Board AdvisorDecision briefs and scoped analysis
Web DesignerDesigns interfaces, accessibility, layouts and experiences
Health AdvisorResearches health information and organizes questions for clinical review
DietitianPlans nutrition, menus and shopping using operator-defined preferences
Records KeeperCatalogs provenance, permissions, retention and retrieval
Dashboard ManagerOperational scorecards, dashboards and access-scoped reporting
Kaizen ImprovementContinuous improvement with measured before/after evidence
Scrum FacilitatorBacklog clarity, sprint planning and impediment tracking
Web Design ManagerDesign systems, accessibility reviews and creative approvals
Web DeveloperSandboxed implementation, testing and release preparation
Advertising SpecialistCreative variants, channel research and compliant ad assets
Campaign ManagerLaunch calendars, attribution and cross-channel coordination
Psychiatry SupportClinician-supervised mental-health intake and appointment preparation
Surveillance & Alarm ChiefAuthorized sensor alarms, incident triage and escalation
Messenger & NotificationApproved messages, reliable delivery and escalation receipts
22 specialist office concepts are shown. New portraits are preliminary illustrations; role-specific permissions remain governed independently of artwork.
Build teams, not a pile of unrestricted bots.
Every office has an explicit job, inputs, outputs, review gates and an audit trail. Development, marketing, operations and personal care stay in separate domains. These are proposed integration patterns—not a claim of deployed autonomous staff.
Dashboard ManagerOperational scorecards, dashboards and access-scoped reportingKaizen ImprovementContinuous improvement with measured before/after evidenceScrum FacilitatorBacklog clarity, sprint planning and impediment trackingWeb Design ManagerDesign systems, accessibility reviews and creative approvalsWeb DeveloperSandboxed implementation, testing and release preparationAdvertising SpecialistCreative variants, channel research and compliant ad assetsCampaign ManagerLaunch calendars, attribution and cross-channel coordinationPsychiatry SupportClinician-supervised mental-health intake and appointment preparationSurveillance & Alarm ChiefAuthorized sensor alarms, incident triage and escalationMessenger & NotificationApproved messages, reliable delivery and escalation receiptsMake the boundaries real. See how XMAN decisions work → · Build and verify workflows in SIDE →
Different responsibilities / separate authority
Watch the machine. Defend the boundaries.
SysOp observes operational health. Security analyzes threats. Neither is allowed to appoint itself root.
◉
SysOp / Operations health
SysOp follows system health, network health, compute capacity, resource pressure, service availability and recovery diagnostics.
- CPU, RAM, disk, temperature and container capacity
- DNS, tunnels, network links and gateway reachability
- Agent runtime status, restart outcomes and alerts
- Proposes fixes through governed requests
◇
Security / Threat analysis
Security reviews suspicious agent behavior and access patterns, looking for indicators of compromise while keeping actual enforcement separate.
- Attack signatures, unexpected commands and anomaly signals
- Suspicious logs, credential use and unusual network access
- Prompt-injection and tool-abuse indicators
- Requests containment and incident response review
The independent control path
Full architecture ↗Agents request. The daemon decides.
Authority is a system property—not something an agent earns by writing convincing prose.
01 / requestScoped agent request
An agent asks to allocate resources, use a tool, or perform a protected operation.
02 / decideXMAN policy daemon
The daemon checks request identity, policy, current limits, and actual system state.
03 / approveOperator authorization
Routine permitted work can proceed; sensitive or privileged actions require explicit approval.
04 / enforceBounded executor
Rootless Podman executes supported actions; a separate privileged executor is a future design.
05 / verifyReadback and audit
Reconcile container state, journal the outcome, and notify the requester.
NO DIRECT ROOT AUTHORITY.Human-approved privileged execution is planned, not yet independently qualified.
Within policy → automatically granted. A bounded +32 MiB Podman resource request is enforced and read back; an outcome is recorded.Interactive illustration based on one reported integration test; this page performs no system operations.
XERXES SI / ENGINEERING PLATFORMAgents execute.
Agents execute.
SIDE develops.
SIDE is the standards-first development environment behind the XERXES SI ecosystem. Let specialized agents research, design and test—while Clawsolator constrains execution and XMAN governs exceptional requests.
See how SIDE actually works →SYSTEM DEVELOPMENT PATH
Define and design in SIDE
Request capacity through XMAN
Run safely inside Clawsolator
Test, verify and preserve results
ONE COMPANY · MULTIPLE SYSTEMS · OPEN INTEGRATIONS
The platform is bigger than a single agent framework.
Clawsolator is one member of the XERXES SI software family. SIDE builds and qualifies systems, Dash X turns operational signals into decision surfaces, the Lattice preserves research and provenance, and OpenClaw is one optional runtime.
XERXES SI ↗
Company, Synthetic Intelligence research, and product ecosystem
xerxessi.comSIDE ↗The standards-first Synthetic Intelligence Development Environment
xside.xerxessi.comDash X ↗Operational systems, evidence, and decision surfaces
dashx.xerxessi.comXERXES Lattice ↗Knowledge objects, provenance, engineering essays, and research
wiki.xerxessi.comOpenClaw ↗Upstream agent framework and its official documentation
openclaw.aiExternal links open official project sites and require internet access. OpenClaw is an independent project; no partnership or affiliation is implied.
ENGINEERING COMPARISON / BASED ON PUBLISHED DOCUMENTATION
Not a new sandbox for the sake of a new sandbox.
OpenClaw
OpenClaw already supports sandboxing and security audits. Its own documentation describes one trusted operator boundary per gateway; mixed-trust deployments require deliberate separation.
Read the official security model ↗OpenShell + NemoClaw
NVIDIA's tooling implements real network, filesystem, process and inference enforcement. This is substantial existing security technology that Clawsolator may integrate, not pretend to supersede.
Review enforcement layers ↗Clawsolator + XMAN
Our product direction connects isolated agent execution with easier lifecycle management, guided setup, bounded resource requests, operator approvals, recovery and multiple business domains. Integration does not remove the need for independent testing.
See the setup walkthrough →XMAN / FOUNDER-SUPPLIED CAPTURE / SAFE RECONSTRUCTION01 / Review the permission boundaryOperators see the capabilities and networking consequences before they commit. 02 / Preserve work before changesDocument maintenance actions, current state, and recovery procedures. 03 / Separate agent from authorityRootless containers, governed requests and a manager workflow independent of agent instructions.
Proof needs a workflow—not a promise.
From the actual XMAN autosetup recording, we recreated the key stages in a legible, privacy-safe clip: permission choices, network warnings, discovery, isolation planning, safe maintenance and private recovery. The original recording is not published.
XMAN / GUIDED SETUP22-SECOND PRIVACY-SAFE RECONSTRUCTION
Recreated from the supplied autosetup recording to remove machine names, paths, identifiers and any incidental sensitive content. Illustrates reviewed policy settings, connection discovery, session isolation, maintenance and recovery. Not an unedited video or a penetration-test result.
Editorial reconstruction based on supplied footage. No raw terminal frame, machine name, token, path, key or private identifier is distributed. Not a verification of completed enforcement.
Research / learn before deploying
Engineering, with receipts.
Examine the security problem, the actual incidents, and the design choices—with outward links to primary sources.
Where agent setups go wrong
Learn why exposed gateways, overly broad permissions and shared secrets create avoidable risks.
Read the report ↗When agents exceed their instructions
Source-linked incident summaries, distinctions between verified loss and disclosed vulnerabilities.
Read the report ↗From agent tools to governed SIDE experiments
The relationship between agent orchestration, development tools, and safe execution boundaries.
Read the report ↗THE INDEPENDENT SECURITY AUTHORITY
A prompt is not a permission system.
OpenClaw can be a useful agent harness. But the model should not get to decide whether its own request is safe. XMAN's non-agent daemon evaluates bounded resource requests against policy and current system state. Sensitive operations belong on a separate operator-approved path.
01 / REQUEST
An agent asks.
It submits a request describing the operation, target, identity and required authority. The request is not an instruction to grant itself access.
02 / POLICY
The daemon evaluates.
Check the active resource ceiling, container generation, authorized operation and policy. Out-of-policy requests are denied or routed to human review.
03 / READBACK
The system proves the result.
A bounded adjustment is applied through the manager, read back from Podman, and recorded. Human-approved privileged execution is a planned additional boundary—not a demonstrated general root executor.
Demonstrated: XMAN handled a 32 MiB container memory increase within policy and verified the Podman result without stopping the container. Not yet demonstrated: a complete root-privilege approval executor, arbitrary email-action interception, or protection against every attack class.
Explore the complete XMAN daemon model → See the redacted real autosetup →
SECURITY INVESTIGATIONS / SOURCES INCLUDED
Someone’s emails. Another agent’s data. Exposed gateways. Malicious skills.
Plain-language case studies explain the failure, what is verified, and which boundary belongs outside the model. The conclusion is not “never use OpenClaw.” It is: do not give a tool more authority than the task demands.
INBOX INCIDENT
“Ask before deleting” was not enough.
A reported account of unexpected email deletion demonstrates the need for separate destructive-action approvals. The report was not independently verified by TechCrunch.
Read the incident and original report →CROSS-AGENT LOSS
A second agent erased the first agent’s data.
A GitHub report describes a separate agent operating with shared host-file permissions, resulting in claimed data loss. The fix is filesystem and authority isolation, not another agent name.
See the root-cause breakdown →Browse all four incident reports → Secure OpenClaw configuration →
Straight answers / technical briefing
Questions engineers and executives actually ask
What is Clawsolator?
Clawsolator is a XERXES SI project for guided deployment and governed operation of multiple AI agents. It combines isolated runtime environments, an XMAN daemon policy path, domain organization and operator review workflows. OpenClaw is one compatible framework, not the foundation of the product.
Why should AI agents not have unrestricted root access?
A prompt can request a safe action, but it is not an operating-system permission boundary. Unrestricted host privileges raise the consequences of mistakes, malicious inputs and compromised tools. Clawsolator instead places privileged decisions behind independent policy and explicit operator authorization.
Does Clawsolator replace OpenClaw?
Not necessarily. It adds deployment, isolation and governance around OpenClaw and is designed to accommodate other frameworks or custom harnesses. OpenClaw can remain useful for its ecosystem and plug-ins without becoming a permanent architectural dependency.