OpenClaw security connector: approvals, identity and audit
Run OpenClaw safely at work: an owner-approved identity per assistant, signed human approval before risky actions, no API key on the machine, one audit trail.
Start here
Connect OpenClaw and NanoClaw to Contro1
Connect OpenClaw and NanoClaw assistants to Contro1: one command per computer, owner approval, approvals for commands, and company apps over MCP.
Updated Oct 21, 2026
One command per computer connects every OpenClaw agent or NanoClaw agent group as its own identity, with you as its accountable owner. Commands and sensitive steps then wait for a named person in Contro1, and each agent can use the company apps it was given.
Who this is for
Assistants that run on your own computer or server and answer you in chat apps. For: OpenClaw, NanoClaw. Acts as: Each agent itself. Credential: A key in the Contro1 service on that computer, which cannot be exported.
One command per computer connects every OpenClaw agent or NanoClaw agent group as its own identity, with you as its accountable owner. Commands and sensitive steps then wait for a named person in Contro1, and each agent can use the company apps it was given.
Before you start
Do these on the computer where OpenClaw or NanoClaw runs, as the operating-system user that runs it, and without sudo. contro1 refuses to run connect under sudo: it asks for administrator approval itself, for the one step that needs it.
You need a Contro1 account (the Free plan is enough), and the openclaw command, or NanoClaw's ncl command, on your PATH.
| Step | What to do | What you should see |
|---|---|---|
| Install the Contro1 CLI | curl -fsSL https://contro1.com/install.sh | sh contro1 --version | The installer ends with "Installed contro1 to <folder>", and contro1 --version prints "contro1 version 0.2.29" or later. On Windows, if contro1 is not found, open a new terminal: the installer added it to your PATH. |
| Sign in to Contro1 on this computer | contro1 auth login | "Logged in as you@company.com (Org: <your organization>)". |
Before you start, step 1: Install the Contro1 CLI
Once per computer. The installer downloads the contro1 program from its official GitHub releases. You can read it first at https://contro1.com/install.sh (PowerShell: https://contro1.com/install.ps1).
What you should see: The installer ends with "Installed contro1 to <folder>", and contro1 --version prints "contro1 version 0.2.29" or later. On Windows, if contro1 is not found, open a new terminal: the installer added it to your PATH.
Before you start, step 2: Sign in to Contro1 on this computer
A browser opens on a Contro1 approval page. Approve it with your Contro1 account.
What you should see: "Logged in as you@company.com (Org: <your organization>)".
Connect OpenClaw
Each OpenClaw agent becomes its own Contro1 agent, with its own key in the Contro1 service and its own private local endpoint. The Contro1 bridge for OpenClaw hands the commands OpenClaw stops for to Contro1, and each agent gets its own Contro1 MCP server for company apps.
| Step | What to do | What you should see |
|---|---|---|
| Connect the OpenClaw agents | contro1 connect openclaw | "Found OpenClaw with 2 agent(s): main, work", the list of changes, "Continue? [y/N]", and after you answer y: "Registering the agent keys with the Contro1 service on this computer (administrator approval required)...". |
| Approve the agents as their owner | connect prints an approval link and waits up to 11 minutes. Open it, check the agents it names, and approve. You become their accountable owner. To make somebody else the owner, run connect with --owner their@email.com, and they approve instead. | "Approve at https://contro1.com/... Code: ABCD-EFGH", then "Approved.", "Configuring openclaw..." and "Checking each agent...". |
| Let connect add the Contro1 MCP servers | openclaw mcp list | "Added the MCP servers contro1-main, contro1-work.", then "MCP connected for main: N actions available." for each agent, and a last line "OpenClaw is connected (2 agent(s)). MCP connected, actions available: ... But it is not working end to end yet:" with the steps below. openclaw mcp list shows contro1-<agent id> for each agent. |
| Make OpenClaw stop for approval | openclaw exec-policy preset cautious openclaw exec-policy show --agent <agent id> | exec-policy show prints the policy in effect for that agent. If it reports that the agent cannot run commands at all (a messaging tool profile), it names the alsoAllow entry to add. |
| Stop the assistant rewriting its own skills | openclaw config set skills.workshop.autonomous.mode off | The command finishes without an error. To also stop an agent patching skills during a conversation, add skill_workshop to that agent's tools.deny. |
| Start the Contro1 bridge for OpenClaw | git clone https://github.com/contro1-hq/contro1-openclaw-connector.git cd contro1-openclaw-connector/examples/typescript npm install cp ../../.env.example .env npm run dev # in a second terminal: curl -s http://127.0.0.1:8092/healthz | curl answers {"ok":true,"transport":"cli",...}. The bridge finds the agent mapping file by itself. For anything beyond a test, run it under your service manager (systemd, launchd or a Windows service) as the same user. |
| Check every line | contro1 doctor openclaw | The first line is "Contro1 doctor: openclaw is connected", and every check under it starts with ✓. A line marked ! or ✗ is followed by "Next (you): <command>". Run that command. |
| Try it | In a chat with your assistant, ask it to run touch ~/contro1-test.txt. | An approval request appears in Contro1. Approve it and the file is created. Reject it and OpenClaw denies the command. Both appear in the agent's activity. |
Connect OpenClaw, step 1: Connect the OpenClaw agents
connect finds OpenClaw and its agents (agents.entries in OpenClaw's configuration), then lists every change it will make before it makes any: the local Contro1 service, one Contro1 MCP server per agent named contro1-<agent id>, tool rules so each agent sees only its own server, and the bridge settings file ~/.openclaw/contro1.env.
At "Continue? [y/N]" type y. It then asks once for administrator approval, to register the agent keys with the Contro1 service: a Windows administrator prompt, or your password on macOS and Linux.
What you should see: "Found OpenClaw with 2 agent(s): main, work", the list of changes, "Continue? [y/N]", and after you answer y: "Registering the agent keys with the Contro1 service on this computer (administrator approval required)...".
Connect OpenClaw, step 2: Approve the agents as their owner
connect prints an approval link and waits up to 11 minutes. Open it, check the agents it names, and approve. You become their accountable owner. To make somebody else the owner, run connect with --owner their@email.com, and they approve instead.
What you should see: "Approve at https://contro1.com/... Code: ABCD-EFGH", then "Approved.", "Configuring openclaw..." and "Checking each agent...".
Connect OpenClaw, step 3: Let connect add the Contro1 MCP servers
Nothing to type: this is the end of the same run. connect backs up openclaw.json, then sends all the servers and tool rules to OpenClaw as one change, through OpenClaw's own configuration commands: the running gateway applies it live, and with no gateway running it uses openclaw config patch. contro1 never edits openclaw.json itself. Then it calls each server the way an MCP client does.
What you should see: "Added the MCP servers contro1-main, contro1-work.", then "MCP connected for main: N actions available." for each agent, and a last line "OpenClaw is connected (2 agent(s)). MCP connected, actions available: ... But it is not working end to end yet:" with the steps below. openclaw mcp list shows contro1-<agent id> for each agent.
Connect OpenClaw, step 4: Make OpenClaw stop for approval
Contro1 can only decide what OpenClaw stops for, and connecting does not change OpenClaw's exec policy. The cautious preset makes every command outside the allowlist wait for approval, and refuses it when nobody answers.
What you should see: exec-policy show prints the policy in effect for that agent. If it reports that the agent cannot run commands at all (a messaging tool profile), it names the alsoAllow entry to add.
Connect OpenClaw, step 5: Stop the assistant rewriting its own skills
By default OpenClaw lets an assistant save and rewrite its own skills (skills.workshop.autonomous.mode is auto). Turn that off. config set refuses while the gateway runs, so stop the gateway first, or make the same change in the Control UI.
What you should see: The command finishes without an error. To also stop an agent patching skills during a conversation, add skill_workshop to that agent's tools.deny.
Connect OpenClaw, step 6: Start the Contro1 bridge for OpenClaw
The bridge watches OpenClaw for commands waiting for approval, sends each one to Contro1, and applies the decision back. It holds no key: it talks to each agent's private local endpoint. It needs Node.js and npm, and must run as the same operating-system user that ran contro1 connect, because the endpoints refuse anyone else.
What you should see: curl answers {"ok":true,"transport":"cli",...}. The bridge finds the agent mapping file by itself. For anything beyond a test, run it under your service manager (systemd, launchd or a Windows service) as the same user.
Connect OpenClaw, step 7: Check every line
doctor checks the Contro1 service, every agent's mapping and private endpoint, an approval round trip (a preview, nothing is created), each agent's MCP server with a live call, that each agent sees only its own server, and that OpenClaw accepts its configuration.
What you should see: The first line is "Contro1 doctor: openclaw is connected", and every check under it starts with ✓. A line marked ! or ✗ is followed by "Next (you): <command>". Run that command.
Connect OpenClaw, step 8: Try it
In a chat with your assistant, ask it to run touch ~/contro1-test.txt.
What you should see: An approval request appears in Contro1. Approve it and the file is created. Reject it and OpenClaw denies the command. Both appear in the agent's activity.
Connect NanoClaw
Each NanoClaw agent group becomes its own Contro1 agent. NanoClaw already holds some steps for an admin (credential use, package installs, new MCP servers, new agents); with Contro1 those approval cards go to the agent's reviewer in Contro1 instead of one admin's chat.
Two steps here happen inside NanoClaw and are easy to miss: installing the Contro1 channel, and making Contro1 an approver. Skip either and everything says connected while no approval ever arrives. connect and doctor both name them until they are done.
| Step | What to do | What you should see |
|---|---|---|
| Connect the agent groups you mean | ncl groups list contro1 connect nanoclaw --agent <agent-group-id> | "Found NanoClaw with 1 agent(s): <group name>", the list of changes, and the administrator prompt. |
| Approve the groups as their owner | connect prints an approval link and waits up to 11 minutes. Open it, check the groups and where each one answers, and approve. You become their accountable owner, unless you passed --owner. | "Approve at https://contro1.com/... Code: ABCD-EFGH", then "Approved." and "Configuring nanoclaw...". |
| Let Contro1 resolve approvals in the group | ncl users create --id contro1:approvals ncl roles grant --role admin --user contro1:approvals --group <agent-group-id> | The run continues with "Checking each agent..." and ends with "NanoClaw is connected (1 agent(s)), but it is not working end to end yet:" and a list of what is left, which is the next steps on this page. |
| Install the Contro1 channel into NanoClaw | REF=v0.2.4 BASE=https://raw.githubusercontent.com/contro1-hq/contro1-nanoclaw-connector/$REF/nanoclaw/src/channels curl -fsSL "$BASE/contro1.ts" -o src/channels/contro1.ts curl -fsSL "$BASE/contro1-governance.ts" -o src/channels/contro1-governance.ts echo "import './contro1.js';" >> src/channels/index.ts # Step 4 of skills/add-contro1: make approval cards prefer the contro1 channel pnpm run build # then restart NanoClaw the way you normally run it | pnpm run build finishes without errors, and after the restart NanoClaw loads the contro1 channel. The channel finds the mapping file by itself. |
| Company apps, if this group should use them | contro1 apps enable nanoclaw --agent <agent-group-id> | If the owner still has to allow applications, it prints the page where they do and waits up to 10 minutes. It then lists the local changes (ncl groups config add-mcp-server --id <agent-group-id> --name contro1 --url https://api.contro1.com/api/centcom/mcp, then ncl groups restart --id <agent-group-id>) and ends with "<group> can now reach the applications its owner allowed, through Contro1." |
| Check every line | contro1 doctor nanoclaw | The first line is "Contro1 doctor: nanoclaw is connected", every check starts with ✓, and "Approvals reach Contro1 for <group>" says "Approvals for this agent come to Contro1." |
| Try it | In a connected group, ask the assistant to do something NanoClaw holds for approval, such as installing a package. | The approval card arrives in Contro1, for the agent's reviewer (its owner, unless they routed it to someone else). Decide it there and NanoClaw applies or declines the change. |
Connect NanoClaw, step 1: Connect the agent groups you mean
List the groups first and name the ones to connect. On a host with several groups, connect will not take all of them by itself.
connect lists what it will change (the channel settings file ~/.config/nanoclaw/contro1.env, and the credential step for company apps), asks "Continue? [y/N]" (type y), and then asks once for administrator approval.
What you should see: "Found NanoClaw with 1 agent(s): <group name>", the list of changes, and the administrator prompt.
Connect NanoClaw, step 2: Approve the groups as their owner
connect prints an approval link and waits up to 11 minutes. Open it, check the groups and where each one answers, and approve. You become their accountable owner, unless you passed --owner.
What you should see: "Approve at https://contro1.com/... Code: ABCD-EFGH", then "Approved." and "Configuring nanoclaw...".
Connect NanoClaw, step 3: Let Contro1 resolve approvals in the group
The same run then asks a second, separate question: "Change who can resolve approvals in these groups?" It creates the NanoClaw user contro1:approvals and makes it an admin of each connected group, so the Contro1 channel can answer the approval cards. This changes who approves in NanoClaw, so it needs a person at the terminal: --yes never covers it. Type y.
What you should see: The run continues with "Checking each agent..." and ends with "NanoClaw is connected (1 agent(s)), but it is not working end to end yet:" and a list of what is left, which is the next steps on this page.
Connect NanoClaw, step 4: Install the Contro1 channel into NanoClaw
connect does not do this one, because it changes NanoClaw's own source code. In your NanoClaw checkout, follow skills/add-contro1 in the connector repository, or give that skill to the coding agent that maintains your NanoClaw. It copies two files into src/channels/, adds one import, and makes approval cards prefer Contro1 (step 4 of the skill), so a card raised in WhatsApp still comes to Contro1. Then build and restart NanoClaw.
What you should see: pnpm run build finishes without errors, and after the restart NanoClaw loads the contro1 channel. The channel finds the mapping file by itself.
Connect NanoClaw, step 5: Company apps, if this group should use them
connect already tries this. When the owner has allowed applications for the connection and OneCLI is installed on the host, it gives the group a Contro1 MCP server by URL (no credential is written where the agent could read it), keeps a credential for that one group in OneCLI, and restarts that group. When something is missing, the list at the end of connect has a line starting "Applications for <group>:" that names it. Do what it says, then run:
What you should see: If the owner still has to allow applications, it prints the page where they do and waits up to 10 minutes. It then lists the local changes (ncl groups config add-mcp-server --id <agent-group-id> --name contro1 --url https://api.contro1.com/api/centcom/mcp, then ncl groups restart --id <agent-group-id>) and ends with "<group> can now reach the applications its owner allowed, through Contro1."
Connect NanoClaw, step 6: Check every line
The line to read carefully is "Approvals reach Contro1 for <group>". It is the one that catches a missing channel or a missing role.
What you should see: The first line is "Contro1 doctor: nanoclaw is connected", every check starts with ✓, and "Approvals reach Contro1 for <group>" says "Approvals for this agent come to Contro1."
Connect NanoClaw, step 7: Try it
In a connected group, ask the assistant to do something NanoClaw holds for approval, such as installing a package.
What you should see: The approval card arrives in Contro1, for the agent's reviewer (its owner, unless they routed it to someone else). Decide it there and NanoClaw applies or declines the change.
Give it something to do
A connected agent starts with nothing. It can ask people for approval and report what it did. To use an application such as Gmail, two things happen in Contro1:
- Apps: an administrator turns the application on for the organization and chooses which of its Actions are allowed. That alone gives no agent a tool.
- Access: a person opens the agent, connects the account it should use (a shared team account, or their own), ticks the Actions it may run, and presses Save. People can do this for their own agents, within what the organization allows.
- A personal account, such as your own mailbox, is always used on your behalf. When you are the agent's owner and give it your own account in Access, that is recorded as you letting it act for you. Anybody else whose account it should use turns that on for the agent in Access themselves.
- The agent's page shows a "Get it working" card with three steps: Connected to Contro1, Can do something, Did something. It always shows the next one to do, and it disappears once all three are done.
What this does not secure
- Which chat an instruction came from. An assistant that sits in a group chat cannot tell a request from the group apart from a request from you. Contro1 states on every request that it cannot name who could have asked, and warns the owner when such an agent uses a personal account. The safest answer is a separate agent per group, which starts with nothing.
- Actions the assistant does not stop for. OpenClaw commands on the allowlist run without Contro1. Other OpenClaw tools are covered only if the optional ClawHub plugin pauses them.
- Isolation between agents on one OpenClaw gateway. They run as the same operating-system user, so the per-agent MCP rules are tool rules, not an operating-system boundary. Keep the cautious exec policy.
When something does not work
| What you see | What to do |
|---|---|
| connect --yes stops and asks you to name agents | More than one agent was found. Add --agent <id> for each one to connect. |
| Commands run without any approval | OpenClaw is not stopping for them. Run openclaw exec-policy preset cautious, and check the bridge is running as the same user. |
| The assistant says it cannot run commands | Its tool profile excludes terminal tools. openclaw exec-policy show --agent <id> names the alsoAllow entry to add. |
| openclaw mcp add or openclaw config set refuses | The gateway is running. Stop it, use openclaw gateway call config.patch, or use the Control UI. |
| An agent shows "MCP error -32000: Connection closed", or says it is not connected | Run contro1 doctor openclaw. A server that cannot find its connection stays up and offers one tool, contro1_setup_required, whose text is the fix. |
| MCP works but shows 0 actions, or the agent cannot use an app | The connection is Approvals only, or the app was not given to this agent in Access. contro1 doctor shows the mode; the owner can allow applications from the agent in Access. |
| NanoClaw is connected but no approval ever arrives | The Contro1 channel is not installed, or Contro1 is not an approver. Read "Approvals reach Contro1" in contro1 doctor nanoclaw. |
OpenClaw guide · NanoClaw guide · OpenClaw connector on GitHub · NanoClaw connector on GitHub
Frequently asked questions
Does connecting give my assistant access to my mailbox?
No. Connecting gives it an identity and a way to ask people for approval. It uses an application only after somebody gives that agent specific Actions in Access, and a personal account only on behalf of the person it belongs to.
Do I put a Contro1 API key in OpenClaw or NanoClaw?
No. Each agent's key stays in the Contro1 service on the computer and cannot be exported. The bridge and the NanoClaw channel refuse to start if a static Contro1 key is in their environment.
Can I connect only some of my agents?
Yes. Name them with --agent <id>, once per agent. On NanoClaw that is the normal way: connect never takes every group on the host by itself.
Related resources
NanoClaw security and admin approvals for teams
Take NanoClaw from one admin DM to a team: credential use, package installs, MCP servers and new agents go to the right reviewer, with an owner and audit trail.
Contro1 CLI
Install and use the contro1 CLI to register AI agents, create approval requests, push AI inventory, retrieve evidence and traces, and test workflows before using the SDK or API.
Contro1 Action Gateway
Choose the applications your organization approves, decide who may do what, and connect one MCP. Every person and agent gets exactly their access, and every action is recorded on their name.