openclaw - 💡(How to fix) Fix [Feature]: Multi-agent trust boundaries for claw [2 comments, 2 participants]

Summary

When multiple claw instances need to collaborate, the only trust mechanism today is the system prompt. PAP is an open protocol that enforces context boundaries and authorization at the transport layer — before execution, not after.

Problem to solve

Multi-instance orchestration has no trust model. Instance A knows your calendar. Instance B knows your finances. When they coordinate, there is no enforcement preventing context bleed across skill boundaries. ClawHub plugins compound this — a skill you didn't write runs with the same access as one you did. There is no audit trail for what was authorized, by whom, or when.

Proposed solution

Integrate PAP as an optional trust layer for skill execution and inter-instance communication. Agents declare what context they need. The principal hierarchy enforces what they actually receive. Every action is signed and auditable. Claw stays claw — PAP sits underneath it.

https://baur-software.github.io/pap/pap/

Alternatives considered

Prompt-based sandboxing — doesn't hold under third-party skills or multi-instance coordination. Per-skill OAuth scoping — addresses permissions but not context leakage or auditability between agents.

Impact

Unlocks safe multi-instance orchestration. Makes ClawHub a less attractive attack surface. Gives power users an auditable record of every agent action. Sets claw up as enterprise-ready without changing the core UX.

Evidence/examples

The insurance company incident in the shoutouts wall is the clearest example. An agent acted on a misinterpretation with no authorization checkpoint and no audit trail. PAP puts the checkpoint before execution, not in the apology after.

Additional information

No response