GoClaw was inspired by projects like OpenClaw, but it diverges significantly in one critical area: Security & Trust.
The fundamental problem with many existing AI Agent frameworks (AutoGPT, OpenClaw, LangChain) is the unchecked execution of arbitrary code, unlimited shell access, and untrusted third-party tool execution.
GoClaw solves this by treating the agent not as an all-powerful script kiddie, but as an Enterprise AI Employee (Level 4) that operates strictly within a Zero-Trust, Built-In Tool Ecosystem.
This document outlines the 5 levels of AI Autonomy and how GoClaw safely implements them without compromising the host system.
pdftotext when present). The one way to add outside tools is an MCP server: one an admin configures under mcp.servers in config.yaml, or one a plugin brings and an admin approves. A stdio server is a process the gateway starts, often through npx or uvx, so it brings that runtime and its packages with it. If a tool isn't compiled into the binary, provided by such a server, or explicitly permitted via the SKILL.md / config.yaml allowlists, the agent cannot use it.shell_exec tool operates on a strict Allowlist (e.g., ls, grep, cat, top). It blocks dangerous operations (pipes, output redirection, executing downloaded binaries).db_query, mongo_query) enforce Read-Only (SELECT/SHOW) operations. DDL/DML (DROP, DELETE, UPDATE) are hard-coded to fail. There are two exceptions. db_write inserts, updates and deletes by key, only on a datasource marked allow_write, only for an admin or a SOP or cron run, and capped in the rows it may touch. metrics_store creates and writes its own agent_metrics table on a datasource, under the same allow_write and caller rules, never for a webhook-triggered or delegated run.~/.goclaw/workspace).shell_exec tool during that specific step.Autonomy: 0% (Human drives, AI responds) Definition: The AI can only read its training data and the context provided in the immediate chat prompt. It cannot take actions. GoClaw Implementation:
goclaw chat CLI mode.SOUL.md).Autonomy: 20% (Human drives, AI suggests and reads context)
Definition: The AI can read the environment (local files, current git branch, screen content) to provide highly contextual suggestions, but the human must execute the final action (e.g., hitting Tab to complete code, or clicking "Apply").
GoClaw Implementation:
file_read, repo_map, memory_search, gitlab (read operations).Autonomy: 60% (Human assigns a goal, AI executes via a ReAct loop) Definition: The AI is given a goal ("Find the bug in login.go and fix it") and is trusted to select its own tools, iterate through errors, and execute changes. GoClaw Implementation:
Autonomy: 95% (AI executes long-running processes, learns from humans, and generates professional artifacts) Definition: The AI operates proactively, follows strict SOPs, and most importantly, learns from every interaction. It doesn't just chat; it produces work products (PDFs, HTML dashboards) and refines its own knowledge base. GoClaw Implementation:
Autonomy: 100% (AI defines its own goals, creates its own tools, manages its own resources) Definition: The AI operates an entire business or system end-to-end without human oversight. It writes its own SOPs and provisions its own infrastructure. GoClaw Implementation:
update_core_instruction) only in a human admin's conversation, at that admin's request; SOP, cron and webhook runs are refused. Humans remain in control of the config.yaml and SOP definitions.By compiling trusted tools directly into the binary and replacing probabilistic "ReAct" loops with deterministic SOP workflows, GoClaw provides the autonomy of a Level 4 AI Employee with the security guarantees of a traditional enterprise application.