# AI Autonomy Levels & Security Philosophy in GoClaw GoClaw was inspired by projects like OpenClaw, but it diverges significantly in one critical area: **Security & Trust**. The fundamental problem with many existing AI Agent frameworks (AutoGPT, OpenClaw, LangChain) is the unchecked execution of arbitrary code, unlimited shell access, and untrusted third-party tool execution. GoClaw solves this by treating the agent not as an all-powerful script kiddie, but as an **Enterprise AI Employee (Level 4)** that operates strictly within a **Zero-Trust, Built-In Tool Ecosystem**. This document outlines the 5 levels of AI Autonomy and how GoClaw safely implements them without compromising the host system. --- ## 🛡️ The GoClaw Security Philosophy 1. **Built-In Over Bolted-On:** GoClaw ships as a single compiled binary. Its tools (GitLab, ClickHouse, Shell, PDF parsing, Memory Search) are *built into* the binary. They do not install Python packages, Node modules, or external curl scripts; a few call programs that must already be on the host (Chrome for the browser and PDF reports, linters such as golangci-lint or ruff, `pdftotext` when present). The one way to add outside tools is an MCP server: one an admin configures under `mcp.servers` in `config.yaml`, or one a plugin brings and an admin approves. A stdio server is a process the gateway starts, often through `npx` or `uvx`, so it brings that runtime and its packages with it. If a tool isn't compiled into the binary, provided by such a server, or explicitly permitted via the `SKILL.md` / `config.yaml` allowlists, the agent cannot use it. 2. **Principle of Least Privilege (Sandboxing):** - The `shell_exec` tool operates on a strict **Allowlist** (e.g., `ls`, `grep`, `cat`, `top`). It blocks dangerous operations (pipes, output redirection, executing downloaded binaries). - Database tools (`db_query`, `mongo_query`) enforce **Read-Only (SELECT/SHOW)** operations. DDL/DML (DROP, DELETE, UPDATE) are hard-coded to fail. There are two exceptions. `db_write` inserts, updates and deletes by key, only on a datasource marked `allow_write`, only for an admin or a SOP or cron run, and capped in the rows it may touch. `metrics_store` creates and writes its own `agent_metrics` table on a datasource, under the same `allow_write` and caller rules, never for a webhook-triggered or delegated run. - File system access is strictly jailed to the configured Workspace directory (`~/.goclaw/workspace`). 3. **Human-in-the-Loop (HITL):** Critical actions (merging code to production, moving money, mutating infrastructure) must be delegated to a specific SOP step that halts execution and requests explicit human approval via Discord/Teams/Web UI. 4. **Deterministic Boundaries:** Level 4 SOPs define *exactly* which tools are allowed at which step. An agent tasked with "Reviewing a Pull Request" is physically prevented from using the `shell_exec` tool during that specific step. --- ## 📈 The 5 Levels of AI Autonomy ### 🟢 Level 1: Conversational AI (Chatbots) **Autonomy:** 0% (Human drives, AI responds) **Definition:** The AI can only read its training data and the context provided in the immediate chat prompt. It cannot take actions. **GoClaw Implementation:** - Secure by default. Interactive `goclaw chat` CLI mode. - System prompt enforces the persona (`SOUL.md`). ### 🟡 Level 2: AI Copilot (Context-Aware Assistants) **Autonomy:** 20% (Human drives, AI suggests and reads context) **Definition:** The AI can read the environment (local files, current git branch, screen content) to provide highly contextual suggestions, but the human must execute the final action (e.g., hitting `Tab` to complete code, or clicking "Apply"). **GoClaw Implementation:** - Uses read-only tools: `file_read`, `repo_map`, `memory_search`, `gitlab` (read operations). - **Security Boundary:** The agent can see the code, but it cannot commit or push without explicit instruction. ### 🟠 Level 3: Autonomous Agents **Autonomy:** 60% (Human assigns a goal, AI executes via a ReAct loop) **Definition:** The AI is given a goal ("Find the bug in login.go and fix it") and is trusted to select its own tools, iterate through errors, and execute changes. **GoClaw Implementation:** - Restricts autonomy using built-in **Safe HTTP Clients** with SSRF protection. - **Event-Driven Proactivity:** Beyond simple prompt-response, the **Webhook Router** allows agents to react to external triggers (GitLab MRs, Zabbix alerts) autonomously. ### 🔵 Level 4: AI Employee / Digital Workforce (GoClaw's Target) **Autonomy:** 95% (AI executes long-running processes, learns from humans, and generates professional artifacts) **Definition:** The AI operates proactively, follows strict SOPs, and most importantly, **learns from every interaction**. It doesn't just chat; it produces work products (PDFs, HTML dashboards) and refines its own knowledge base. **GoClaw Implementation:** - **Continuous Learning (Fact Extraction):** Automatically extracts concrete facts (IP changes, config hints, user rules) from conversations and persists them to long-term memory. - **Conflict-Aware Memory:** Smartly replaces old facts (e.g., outdated IPs) with new ones, ensuring the "Digital Employee" never gets confused by stale data. - **Actionable Reporting:** Generates professional **PDF reports** (with Mongolian support) and **HTML dashboards** with TTL security, turning raw data into executive-ready artifacts. - **State-Machine SOPs:** JSON-defined workflows with strict success criteria and automated reflection. - **Asynchronous Background Processing:** Decouples heavy memory tasks (extraction, consolidation, KG sync) into a persistent **Job Queue** and dedicated **MemoryWorker**, ensuring system responsiveness and stability while operating at scale. - **Token Analytics:** Built-in dashboard to monitor ROI and prevent cost overruns. ### 🟣 Level 5: Fully Autonomous Entity (AGI) **Autonomy:** 100% (AI defines its own goals, creates its own tools, manages its own resources) **Definition:** The AI operates an entire business or system end-to-end without human oversight. It writes its own SOPs and provisions its own infrastructure. **GoClaw Implementation:** - **Not implemented.** No part of Level 5 is built. The [Level 5 vision](../vision/level5.md) describes it only as *governed* autonomy: agents propose goals, run experiments and suggest SOPs and tools, and a person or a policy approves each one. Unsupervised self-direction (an agent setting its own goals, provisioning its own resources or rewriting its boundaries without review) stays out of scope. Today agents may not change system boundaries or bypass the persistence layer. The agent changes its own core instruction (`update_core_instruction`) only in a human admin's conversation, at that admin's request; SOP, cron and webhook runs are refused. Humans remain in control of the `config.yaml` and SOP definitions. --- ## 🚀 Conclusion By compiling trusted tools directly into the binary and replacing probabilistic "ReAct" loops with deterministic SOP workflows, GoClaw provides the autonomy of a **Level 4 AI Employee** with the security guarantees of a traditional enterprise application.