Remote approvals for unattended agent runs. A signed record of every decision.
Let the routine work continue. Review the actions your policies hold, then allow or deny them from the dashboard or phone.
Installs the runtime, provisions Postgres, mints your key, and wires your first hook. No account on the path to your first caught action.
Rather not deploy yet? The hosted trial lets you see the Approvals inbox in your browser, no install.
Enforced at the hook seam in Claude Code, Codex, and Hermes, and at the OpenClaw gateway. Honored cooperatively by the Node and Python SDKs, the MCP server, and REST.
- agent_id
- deploy-bot
- action_type
- deploy
- declared_goal
- "Ship auth-service v2.1 to production"
- risk_score
- 92 / 100
- matched_policy
- production_deploy_gate
- REQUIRE_APPROVALheld, routed to on-call+0.3s
- approved by wes via Discord+41s
- caller reported outcome success+47s
Live policy evaluation, real demo endpoint
Try a live policy evaluation
Pick a declared action and inspect the policy decision returned by the demo endpoint. This bare guard call is cooperative and does not bind or execute an external act.
await claw.guard({
agent_id: 'openai-deployer-1',
action_type: 'deploy',
risk_score: 85,
declared_goal: 'Deploy auth-service v2.1 to production with new session token rotation.',
});Pick an action and click Evaluate. The result will appear here, including the matched policy, the risk score, and what a human approver would see.
Policy decisions come from the demo deployment. Approval clicks are illustrative local state so visitors can explore the interface without an account; they do not approve server-side work. Your own instance records approval decisions through /api/actions/:id/approve.
Native permission prompts protect you at the keyboard. DashClaw protects the runs you walk away from.
Claude Code and Codex already ship permission prompts for the at-keyboard user, for free. DashClaw does not compete with those. It does the job those prompts structurally cannot, because they need you present: it freezes the dangerous call and lets you approve it minutes or hours later, from anywhere.
| Dimension | Native permission prompts | DashClaw |
|---|---|---|
| Who it protects | You, while you watch each prompt | The run you walked away from |
| When you must be present | Each prompt, in real time | Only when a policy holds work; resolve from a phone |
| Policy scope | Per session, per machine allowlist | Shared policy service across integrated runtimes |
| Audit trail | No shared export | Replayable records with explicit signature status |
| Interruption rate | Fixed prompts, no tuning | Calibrated to a target false-block bound |
This is not observability either. LangSmith and Langfuse record what an agent did after it ran. On an enforcing integration, DashClaw evaluates policy before the supported call runs.
The whole product is one loop
Intercept, decide, approve, record. Hooks and OpenClaw own an enforcing seam. Node and Python runGoverned require a confirmed protocol-1 execution claim before the callback. Bare MCP and REST integrations must honor decisions cooperatively.
const claw = new DashClaw();
// Requires a server that advertises execution claim protocol 1.
await claw.runGoverned(
{ kind: 'shell', command: 'git push --force origin main' },
{
action_type: 'shell',
declared_goal: 'Force-push the rebased branch',
},
() => run(),
);
// runGoverned checks current policy, waits if needed, claims one
// exact act and principal-bound attempt, then records its outcome.
// An uncertain claim or outcome must be reconciled, not retried blindly.Intercept
A PreToolUse hook in Claude Code, Codex, or Hermes, the OpenClaw gateway, or bounded dashclaw_invoke can halt a supported tool call before it executes.
Decide
The guard engine risk-scores the call against your policies into the lattice allow < warn < allow_contained < require_approval < block. The join is max, and a block is absolute.
Approve
require_approval holds the action for a human verdict. Protocol 1 consumes approval or plan authority in the same database statement that claims one fresh, exact-act, principal-bound attempt. This prevents duplicate authority inside DashClaw; it does not make an external effect exactly once. Containment can stage supported file or Postgres work for later promotion or discard.
Record
Recorded decisions and outcomes form a replayable audit trail with explicit identity and payload-signature status. The liveness probe is a timestamped client report from an installed seam, not continuous attestation.
Three things make the checkpoint livable
A governor you disable is worse than none. These three keep it earning its interruptions, report whether an installed seam held a probe, and compare agent confidence with reported outcomes.
Calibrated interruptions
A distribution-free controller tunes the interruption threshold from your approve and deny stream, with a proven false-block bound. It runs in shadow first, then loosens as well as tightens: the things you keep approving stop asking, never further than the riskiest action you approved, and one deny takes the band straight back. Governance earns its interruptions instead of nagging you into turning it off.
Enforcement liveness
An installed client periodically drives a synthetic held action through its hook seam and reports whether it executed. The report is point-in-time evidence from that client. Missing or stale reports never render green.
Predicted vs actual
Recorded actions can carry the agent's stated confidence. The ledger compares it with agent-reported terminal outcomes over 30 days. That outcome is an audit assertion; consequential external state still needs reconciliation.
Definitions, theorems, and honest limits are in the governance core theory doc.
It meets your agent where it already runs
Installers wire supported Claude Code, Codex, and Hermes hook events. OpenClaw has a gateway plugin. The MCP server exposes 17 tools and 3 resources to MCP clients, which still need to call them and honor the result. Custom runtimes can use the Node or Python SDK.
# No clone required — the CLI downloads the hooks bundle
# from your instance, wires ~/.claude/settings.json, and
# defaults to observe mode.
npm i -g @dashclaw/cli
dashclaw install claude # prompts for endpoint + API key
dashclaw install claude --trial # hosted signup, paste the key
# Governs Bash, Edit, Write, MultiEdit, Agent/Task, mcp__* tools.
# Flip to enforce: set DASHCLAW_HOOK_MODE=enforce in
# ~/.dashclaw/claude-hooks/.envWhere the block is mechanical, and where it is honored
We do not claim universal enforcement. We publish the table.
Mechanical halt
Claude Code, Codex, and Hermes lifecycle hooks (fail-closed, exit-2 on block), the OpenClaw gateway, and dashclaw_invoke. The action is stopped in the seam before it runs.
Honored and recorded
Bare SDK, MCP, and chat-based callers consult guard and honor the decision cooperatively. Calls submitted to DashClaw are recorded, and a block is never downgraded in the ledger. The server cannot observe a cooperative caller that skips the protocol. SDK callers can attach the actual command or request so policy binds to evidence instead of only a declaration.
One more honest line: the hook runs at your agent's own privilege level. It is a seatbelt against accidents, not a cage against intent. DashClaw can record attempted edits and later probe failures, but a same-user process can tamper with its own hook. A stronger boundary comes from your deployment (a container, a separate OS user, or a read-only hook path), not from software running inside the agent's reach.
Governance can be narrowed as well as switched off, and that is loud too. DASHCLAW_GOVERNED_CATEGORIES decides which tool categories reach the guard at all, so an excluded category produces no row and its silence looks exactly like a quiet agent. The hook declares what it is not governing, and any gap raises a red Governance scope narrowed signal naming what stopped being watched. Visibility, not enforcement: a client that narrows its own scope can also lie about the declaration, which is why the boundary above still matters.
The full per-surface table and threat model live in the enforcement boundary doc.
What developers use DashClaw for
Three patterns that come up in every production agent stack.
Stop runaway deployments
One approval before production, full audit trail after.
await claw.guard({
agent_id: 'deploy-bot',
action_type: 'deploy',
risk_score: 92,
declared_goal: 'Ship auth-service v2.1 to prod',
});Matched the production_deploy policy, paused the action, routed to the on-call engineer, recorded the approval.
Every governed action also lands in the signed decision ledger, ready to audit and export without a separate pipeline.
One primary surface, and the switches around it
The Approvals inbox is the front door. Everything else reads from the same ledger the loop writes.
Approvals inbox
The primary human surface for recorded work waiting on you. Each item shows the redacted act bound to the decision, its risk, and the available allow or deny controls. Resolve from a browser, CLI, phone, Telegram, or Discord when that channel is configured.
Decisions ledger
Recorded governed actions with their declared goal, bound act, risk composition, matched policies, approver, outcome, verified-identity state, payload-signature state, and the model and harness the client declared it was running on.
Policies
A short list of things that stop your agent, with other recorded traffic measured. The default pack holds only its explicit evidence-matched catastrophes.
Fewer interruptions, earned
Starts in preview on day one. Learns from your verdicts — including one-click retrospective calls on things that never interrupted you — and only gets quieter until you say otherwise.
Enforcement liveness
An installed client can drive a synthetic held action through its hook seam and report whether it executed. Setup shows the report time and renders missing or stale evidence explicitly; it is not continuous attestation.
Pulse
A small always-on-top window that answers one question from across the room: is anything owed? A dim dash when nothing is, the pending count when something waits, and honesty rules that keep a dead pipe from ever rendering as calm. Read-only; opens with one click from the approvals inbox.
dashclaw doctor
Diagnoses the instance and the machine: database, config, auth, deployment, SDK reachability, stale installs. Report-only by default.
Put an approval layer in front of your unattended runs.
For the developer who kicks off a long run and cannot watch every tool call.