OpenClaw Sandbox vs Approvals vs Tool Policy: Three Different Safety Layers

<p>Previous parts of <em>Build a Basic AI Agent From Scratch</em>:</p> <ul> <li><a href="https://www.ruxu.dev/articles/ai/build-a-basic-ai-agent/" rel="noopener noreferrer">Basic

<p>Most API documentation is written for humans.</p> <p>MCP tool descriptions are different.</p> <p>They are read by the model that decides what to call next.</p> <p>That means

<p>On March 31, 2026, Anthropic accidentally shipped the entire source code of Claude Code — its flagship AI coding agent — inside a routine npm update. No hack. No reverse

<p>Ask a coding agent to run a build, and you have just handed a language model the ability to <code>cat ~/.ssh/id_rsa</code>. Prompt-level instructions like "do not read

<p>Your agent passed all the tests. It's been running in production for three weeks. And it has been quietly wrong the entire time.</p> <p>This is not a hypothetical. Galileo's

<p>OpenClaw works well enough on a fresh install that most people don’t question the defaults. That’s the problem. The defaults are tuned for demos, not for actual sustained use,

<p><em>Originally published on <a href="https://tamiz.pro/insights/ai-agent-runtimes-constitution-ironclaw-policy-first-autonomous-systems" rel="noopener