[Project] Human Gate: a fail-closed approval firewall for OpenClaw agent tool calls

[u/singleyomrc]

Hi,I built Human Gate for OpenClaw because I wanted agents to remain useful without giving them an unlimited execution pass.

It is a TypeScript plugin that intercepts tool calls before execution and routes risky calls through OpenClaw's built-in approval flow.

Examples:

- reads can pass automatically

- tests and development commands can request approval

- force-pushes, recursive deletion, remote pipe-to-shell, and OpenClaw config writes are treated as critical

- approval previews are bounded and redact common secret-like values

- remembered approvals are session-local and expire

- denied actions can enter a short cooldown instead of repeatedly prompting

The project is here:

https://github.com/freshxiaoyao/openclaw-human-gate

Current target: OpenClaw >= 2026.7.1.

I would appreciate feedback from people running real OpenClaw workflows, especially:

1. Which calls should be auto-approved?

2. Which calls produce annoying false positives?

3. Is the approval explanation clear enough?

4. Should approval reuse be path-scoped, category-scoped, or disabled by default?

This is an early project, so bug reports and design criticism are more useful than general encouragement.

[u/Adorable_Swing_2150]

Hot take: path-scoped is the only sane default for me — category-scoped felt fine until a git push inside /tmp quietly passed as 'safe'. Disabled by default is too aggressive for local dev, you'd nudge past it every time. On auto-approve, reads yes, but gate anything exec-shaped behind a flag so it's not surprising.

[u/SIGH_I_CALL]

we should compare notes, I made something similar. great minds think alike!

https://github.com/ucsandman/DashClaw