If you run agents on OpenClaw and you want judgment instead of raw action, build the agent a gate it can invoke against you, and make “ask me first” a real, defined outcome. I got here after months of misfires. This is what finally made me trust my OpenClaw agent with things I would be upset to lose.
OpenClaw is built to act. It does not wait for a chat prompt. It runs on schedules, wakes itself on a heartbeat, fires cron jobs, spawns sub-agents, runs shell commands, and edits files on its own. That is the point of it, and it is useful. But that same default is the risk. When the agent gets something wrong, it gets it wrong fast, on a schedule, with no one watching.
I felt this directly. I had written instruction files for my agents, SOUL.md and IDENTITY.md among them, that told them what I wanted: be helpful, take initiative, do not wait to be asked, do not delay what you could do today. High agency was the point, and high agency kept producing clean, competent work aimed at the wrong target.
I started calling the pattern tentacle-building. I would ask for a capability close to something the agent already had, and instead of extending what existed, it would write a brand new script for the almost-same job. Then another the next week. Six months in, I had a pile of half-alive scripts, each doing a third of the same job, each on its own schedule, none aware of the others, and nothing tying them together. Every one was competent work, and that is what made it annoying and dangerous. I have built evals to catch a hallucination. A well-built script pointed at the wrong place, running on its own schedule, can sit there for weeks before I notice.
I tried the usual fixes first: a stronger model, more detail in the instructions, “check before you build” written into the prompt in bigger and bigger letters. Each helped a little but none of it resolved the issue. I finally saw that I kept adding instructions to a system whose whole job is to move fast, so one more careful instruction did not slow it down.
What finally worked was a gate. It fires before the first action that changes anything, meaning the first write, command, config change, or any mutating action, not reading and not planning. At that point the agent stops and does four things.
1. Name the domain it is touching, and the specific tool or engine that already owns that domain.
2. Open and read that domain’s existing design record, its decision log and spec, before it writes anything.
3. Restate the task in one sentence, separate what it knows from what it is assuming, and name the most targeted change that could work.
4. Decide whether this is an action it can take on its own. For anything irreversible, expensive, or destructive, it stops and asks me. For the safe and routine work, it proceeds.
The fourth point is the one that matters, and the one that is easy to get wrong. A gate is not “ask permission for everything.” Ask for everything and I start rubber-stamping. So the list of what needs a human is short and explicit: irreversible changes, spending money, anything touching production or credentials. Everything else, it does on its own. The work is in sorting each action into the right pile.
I paired the gate with a second rule, one engine per domain, and that finally resolved the tentacle mess. If a capability already exists for a job, the agent extends it. It does not build a second thing that does the same job a little differently. When it is tempted to start fresh, it has to answer five questions in writing first: What already owns this? What would extending it look like? What is the smallest change to the thing that exists? If I still want a new file, why, concretely? What do I gain from a separate file versus a flag on the old one? “It felt cleaner” is not an allowed answer.
These gates and rules didn’t make the agent smarter but it added friction at the moments where speed had been the problem.
Then it started refusing me. I would ask for something and it would stop, point me back to a decision I had already written down, or tell me the thing already existed and it was not going to build a second one. A tool I built to obey me was citing my own rules back to me and declining. I expected that to annoy me, and it did not. I trusted it more, because I had just watched it stop on its own before doing something I would have had to clean up.
I think this matters more than the direction most of the industry is taking. Everyone is racing to make agents more capable, and you do not have to build capability. The vendors ship more of it every month. You have to build the refusal yourself, the pause before an irreversible action. An agent that cannot say no to you is a fast way to do the wrong thing at scale, and if it has not hurt you yet, that is luck.
I spent the last few months building the guardrails so my OpenClaw is useful but also careful. That is the only reason I now let my agents pick up the work that I cannot easily undo.