v0.1.2 · LIVE on ClawHub · scan documented sha256 3c05f7d2…f970dc3bc · 300+ tests · 26 incidents, public
AI agent security · runtime This isn’t hypothetical

Your agent can delete a directory.
Leak your secrets. Break production.

Our system stops your agents in their tracks — before they go rogue.

A runtime policy layer available now for OpenClaw agents and coming soon to the general public. Allow, confirm, or deny every tool call — before it runs. Not a prompt asking the agent to be careful. A control.

OpenClaw agents — install NIBVOK AI Security now
$ openclaw plugins install @nibvok-llc/nibvok-ai-security
Zero-config · one hook · activates on startup.
Register now for General Public AI Security
By registering you agree we may email you about NIBVOK AI Security — including its general-public launch and related updates — and, as part of that, NIBVOK product news and offers (including other NIBVOK products). Every email has an unsubscribe link and you can opt out any time. You accept our Privacy Policy and Terms.
July 2025An AI coding agent deleted a live production database — records for 1,200+ companies — after its owner told it to freeze all changes. A destructive delete like this is exactly what the layer holds for a human approval — or denies.
2025 · $243,000,000A Miami jury found Tesla's Autopilot 33% liable in a fatal crash — $42.6M compensatory plus $200M punitive.
2024 · HK$200,000,000On a video call where every face was a deepfake, a finance worker approved 15 transfers — US$25.6M gone.
2021 · $304,000,000Zillow shut down its own algorithmic home-buying arm after a $304M writedown — and cut 25% of its staff.
Approval dialog: a confirm decision waiting on a human
0
Entries in the hash-chained audit log — every gate decision and its resolution, written in order.
author's agent · live log
0
Calls blocked on a human approval dialog before they could run.
confirm · human in the loop
0
Destructive calls denied outright — rm -rf, secret reads, guard-disables.
stopped before they ran
0
Tests across five suites — run them yourself for the exact totals.
open suite · repo
FROM THE LOG — counted from the author's own agent, 2026-09-18 → 2026-10-11, read straight from the same hash-chained log the plugin writes (13,992 entries; 10,856 are gate decisions, the rest follow-on resolutions). · INCIDENTS.md (26 case studies, public) · no certification, no safety guarantee — read the honest limits below.
The problem

Deny a tool, or allow a tool.
Neither is the sentence that matters.

OpenClaw's two policy tools both stop short. tools.deny matches tool ids only; tools.exec.mode is one global posture. Neither can say this:

governance-audit.log — every decision is recorded
$tail -f governance-audit.log
The audit log — one line per decision
“Confirm git push --force, deny rm -rf /, and let pytest run silently.”
That needs reading the command, not the tool name — the one decision that has to be made per call, before execution.

Install from ClawHub →

Honest limits

What it does — and what
it does not claim.

What you get — straight, no fine print

  • You'll see every change. Edit a line, reorder it, or delete it — the log shows it. The only way to hide a change is to rebuild the whole file by hand and redo every fingerprint yourself. That's not a slip-up; that's a project.
  • It steps in before the call runs — the one moment that actually matters. Say “go” and it trusts your call. It guards the door; it doesn't second-guess your choices.
  • It's a guard, not a gadget. No dashboard to babysit, no reports to read, no malware scans to run. It makes one call per action: allow it, ask you, or block it.
“We can't say we 100% protect your data — but this extra layer makes you sleep better at night.”

Install from ClawHub →

Get started

Install it where you can
watch the result.

An enforcement layer: install it where you can restart and watch the result.

01

Install

openclaw plugins install @nibvok-llc/nibvok-ai-security

Zero-config. Activates on startup.

02

Confirm it is live

openclaw gateway status

Watch the first decisions land.

03

Verify the audit chain

node verify-audit-chain.mjs

Walk the log; check it holds.

Install from ClawHub →

Evidence — not certification

Every claim here points
at something you can check.

We don't ask you to trust a badge. We hand you the artifact.

01 · Artifact

Named SHA-256

The exact published build, hash-pinned so what you install is the thing that was tested.

sha256 3c05f7d226f46a6c201a4613e1f9275ccc2b858f76588068ad1a154f970dc3bc
02 · Our failures

INCIDENTS.md — public

26 case studies of the layer failing against itself — self-caught bypasses and false passes, each one fixed and kept.

self-caught · fixed · published
03 · Tests

An open test suite

The behaviour is covered by 300+ tests across five suites — run them yourself for the current exact totals.

runnable in the repo
04 · The log

Hash-chained audit

Every decision writes a JSON line whose prev_hash chains to the last. Edits, reorders and removals are detectable.

tamper-evident, not tamper-proof

Install from ClawHub →

Ship with a control, not a wish

Put a guard in the request path.

Allow, confirm, or deny — before the call runs.

Install from ClawHub Read the evidence

Not running an agent yet? NIBVOK AI Security opens to everyone soon. Get told when it opens to everyone →