OpenClaw
OpenClaw drafts server-side policy for hosted gateways
OpenClaw’s hosted-control work proposes enforcing disabled and brokered actions at the gateway dispatch boundary, after normal scope checks but before mutation. A companion browser policy shapes routes and controls; approval work handles turns whose sender cannot authorize the requested command.
openclaw/openclaw PR #116013 is the inspected primary source: “Add hosted Gateway policy enforcement.” The two related records below were inspected as supporting context, not treated as independent confirmation.
The facts
- openclaw/openclaw PR #116013 was created 2026-07-29T17:40:44Z and was open at inspection; its title is “Add hosted Gateway policy enforcement.” - openclaw/openclaw PR #115408 was created 2026-07-28T21:10:37Z and was open at inspection; its title is “Add host Control UI policy.” - openclaw/openclaw PR #115933 was created 2026-07-29T14:08:50Z and was open at inspection; its title is “fix: agent turn dies silently while waiting for an exec approval only someone else can grant.” - The repository reported 384740 stars, 5722 open issues, default branch main, and last push 2026-08-01T00:56:47Z. - The latest tagged-release baseline checked was v2026.7.2-beta.5 published 2026-07-28T03:23:12Z.
What changed
openclaw/openclaw PR #116013 reports: Summary Stacked on #115408. This PR includes the hosted Control UI policy commits from that branch plus the server-side enforcement follow-up: cf5ac27f5b feat: add hosted gateway policy enforcement 4a09753f25 feat: share hosted policy decision contract The new slice adds the matching server-side Gateway contract so the browser presentation policy is not mistaken for an authorization boundary: adds an optional hostGatewayPolicy on GatewayRequestContext enforces enabled / disabled / brokered action state at the Gateway RPC dispatch boundary for operator clients uses one reusable hosted-policy decision shape with state, reason, source, and optional broker supports exact keys, hierarchical wildcards like sessions.*, and same-depth segment wildcards like channels.*.groupPolicy
openclaw/openclaw PR #115408 reports: Summary add an opt-in HostControlPolicyV1 bootstrap contract for hosted Control UI navigation, Gateway path/scopes, and selected UI action preflight keep local OpenClaw default-open: without host config, routes/settings/actions behave as they do today make settings policy intentionally coarse for V1: hosts can set settings read-only through settings["*"] or defaults.setting, but field-level ownership/child editable exceptions are deferred to a later server-enforced config contract hide disabled routes through the top-level router/sidebar/settings navigation instead of touching every page disable session-deletion affordances and read-only config editor controls as presentation UX only honor hosted gateway.scopes even when the browser starts with a bootstrap token, so hosted policy scopes win over the
openclaw/openclaw PR #115933 reports: What Problem This Solves Fixes an issue where an agent turn that triggers an exec approval request would hang and then die in silence — no reply, no error — when the approval can only be granted by someone who is not on that turn. Concretely: an agent talking to a counterpart on WhatsApp asks to run a command that needs approval. The account has approvers configured, and WhatsApp is an approval-capable surface, so the tool call waits inline for the decision. But the person who can approve is on a different surface entirely (an operator DM), and the turn's own liveness watchdog fires at
Why it matters
Hosted UI policy is useful only when the same decision is enforced below the browser. The shared contract makes source, reason and broker visible while keeping local OpenClaw default-open. This is an operator boundary: persisted state, execution ownership and visible controls must describe the same event. A workaround that broadens access, deletes state or hides the symptom would trade a visible defect for an unmeasured one.
Current
The primary record was open when captured on 2026-08-01. The release baseline was v2026.7.2-beta.5 published 2026-07-28T03:23:12Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/openclaw/openclaw/pull/116013. Supporting records are https://github.com/openclaw/openclaw/pull/115408 and https://github.com/openclaw/openclaw/pull/115933. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Test direct RPC calls as well as the browser, keep synthetic in-process dispatch narrowly trusted, and do not claim controls are locked until server policy is wired. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.