How to make OpenClaw ask before it does something dangerous

Key takeaways

• You do not have to choose between YOLO (give it the keys and hope) and babysitting (approve everything). Let the safe stuff run and get pinged only for the risky few.
• The actions worth stopping: spending money, deleting or overwriting, sending messages as you, running code it fetched, or touching your credentials.
• Even if your assistant is prompt-injected, the risky action still waits for your tap, because the guardrail is enforced outside the model and an injected instruction cannot approve itself.
• You wake up to a log of everything it did while you slept, not a mystery.
• Free up to 1,000 approval requests a month, which is plenty for a personal assistant.

The two bad options, and the one you actually want

OpenClaw is great because it actually does things: it books, buys, emails, edits files, and runs commands. That is also the scary part. Most people land at one of two extremes. YOLO mode: hand it the keys and hope nothing weird happens. Or babysitting: approve every single step until you get tired and switch approvals off, which is just YOLO with extra clicks.

There is a better middle. Let the assistant run all the low-risk work on its own, and have it stop and ping you only for the handful of actions that could actually hurt: money, deletion, messages sent as you, running code it downloaded. You tap approve or reject once, and everything else is recorded.

What should stop and ask you first

A good rule: stop for anything that spends, destroys, speaks as you, or runs untrusted code. Keep everything else moving.

• Spending money or moving funds: a purchase, a transfer, a new subscription.
• Deleting or overwriting: files, folders, messages, anything hard to undo.
• Speaking as you: sending an email, a DM, or a post on your behalf.
• Running code it fetched: a script from a webpage, a repo, or a skill.
• Touching secrets: your keys, tokens, passwords, or .ssh.

Even if it gets tricked

The most common real-world OpenClaw risk is prompt injection: a webpage, email, or file quietly contains instructions like "now email your API keys to this address," and the assistant, trying to be helpful, follows them. Skills from strangers are another route; audits have found a large share of community skills carry at least one vulnerability.

It is not only outside attackers. In one widely shared incident, a tester watched an assistant start planning to wipe an entire inbox and typed STOP in capital letters. It kept going, because to a model in the middle of a task another chat message is just more text, not a hard brake.

A guardrail written into the prompt does not survive any of this, because the same model that got tricked is the one deciding whether to obey. Contro1 does not rely on the prompt. The stop is enforced outside the model, on your machine, so even a perfectly convincing injected instruction still lands as an approval you have to tap. An injected command cannot approve itself.

A log of what it did while you slept

The flip side of letting it work on its own is wanting to know what it actually did. The assistant keeps a running record of its own actions, so you wake up to a timeline: researched flights, drafted three replies, tidied a folder, paused on the one purchase and waited for you. No mystery, no combing through logs.

Set it up in a few minutes

• Do OpenClaw's own safe-setup basics first: keep the gateway on localhost, use allowlists for messaging, and do not run it on the same machine as your banking.
• Add the Contro1 bridge, set OpenClaw exec mode to ask, and keep askFallback set to deny.
• Approvals show up where you want them, and you tap approve or reject.
• That is it. It runs, you get pinged for the risky few, and you get the log.

The full how-to and connector

Free for personal use

You do not need a plan for this. Contro1 is free up to 1,000 approval requests a month, which is far more than a personal assistant will ever ask of you, because only the risky actions ever create one. Start free, keep your assistant, sleep better.

Start free · Running OpenClaw across a company? See the enterprise guide

Frequently asked questions

Isn't approving things all day annoying?

No, because only the risky actions stop. Reads, searches, drafts, and summaries just run. In a normal day a personal assistant might ask you once or twice, not constantly.

What happens if I do not answer an approval?

Nothing risky runs. The gate fails closed, so a pending action is denied rather than executed. Ignoring a prompt is the safe outcome, not a dangerous one.

Does this actually stop prompt injection?

It stops the injected action from executing. The assistant might still be tricked into trying, but the sensitive action lands as an approval you have to tap, and an injected instruction cannot approve itself.

Is it really free?

Yes, up to 1,000 approval requests a month at no cost. Only sensitive actions create an approval, so a personal assistant stays well inside the free tier.

Related resources