Requests must match the task
A confused agent can only touch what its task allowed.
Triage the support inbox and reply to thread #4821.
- write
google.gmail · send_message
thread #4821 only
- read
google.gmail · list_messages
inbox · unread
The problem with standing access
The standard agent setup hands over a long-lived API key or a broad-scoped OAuth token and hopes the model behaves. That works until a poisoned web page, a malicious tool result, or a simple misread instruction convinces the agent to do something it was never meant to do. Because the credential already grants everything, there is nothing between the bad instruction and your data. Standing access turns every prompt-injection bug into a potential account-wide incident.
How containment works
Zero standing access
Agents authenticate to Clawvisor, not to your tools. Until a task is approved, the agent can reach nothing: no inbox, no repo, no database.
Per-task grants
Each approved task unlocks exactly the tools and scopes it declared (google.gmail · send_message on one thread, github · list_issues on one repo) and nothing adjacent.
Automatic revocation
When the task completes or times out, the grant disappears. There is no lingering session to steal and no token to rotate after the fact.
Fail-closed everywhere
Anything not explicitly allowed is denied. A request the policy didn't anticipate stops and waits for a human instead of guessing.
The worst an agent can do is the task you approved, and nothing else.
It’s one of the power-ups you get from approving the task instead of the tools.
Purpose verification
You approve a task, not a standing permission. Every request the agent makes is checked against the purpose you approved — a calendar read for your morning briefing goes through, an expense audit across all history does not.
Let your agents act. Safely.
Connect your accounts and put a gatekeeper in front of your agents in minutes. Free to start, no credit card.