Security
One clever prompt won't undo your security.
Four layers, stacked
Each layer is independent. An attacker has to defeat all of them, in order, to do real damage, and any one of them firing stops the chain.
Containment
Agents start with zero standing access and authenticate to Clawvisor, not to your tools. Tools are granted per-task and revoked when the task ends, so the blast radius of any compromise is the task, never the account.
Credential isolation
Real secrets never reach the agent. They stay encrypted in the vault and are attached inside the gateway at call time, so a leaked context or transcript has no credential in it to leak.
Scope & risk gating
Every task is scored for blast radius and every request is checked against the scope you approved and your blocked list of services and actions. High-risk or out-of-scope work stops for a human; routine work flows through. No all-or-nothing approve button.
Full audit logging
Each tool call, argument, and decision is recorded in a complete trail tied to the task and the human who approved it, replayable whenever you need it.
Credential vault
Secrets your agents can use but never see.
Production credentials are stored encrypted in the Clawvisor vault and never leave it. Agents receive nothing in their place: an agent names the service and action it wants, and the gateway attaches the real secret at the edge, so the credential is used without ever entering the model’s context, the tool transcript, or your logs. Rotate the underlying secret in the vault and every agent keeps working, with no agent code or config to touch.
Compliance & data handling
Every claim here is one you can verify yourself.
Clawvisor's gateway source is public — read it, audit it, and run it yourself. Self-host and every credential, log, and request stays inside your own infrastructure, nothing leaves your network. Every agent action lands in a complete, replayable audit trail tied to the task and the person who approved it.
- Source available
- Self-host available
- Encrypted credential vault
- Complete audit trail
Put a gateway in front of your agents.
Run the gateway yourself, or take the managed deployment with org accounts and longer retention.