Agent Passport (OpenClaw)

30-Second Setup

CODEBLOCK0

Templates available: dev-tools · email-team <domain> · file-ops <path> · web-research · safe-browsing · coding · email-assistant · read-only · full-auto
Run ./mandate-ledger.sh templates to see all options.

⚡ Agent Behavioral Contract

If you are an agent reading this skill, these are your rules. Follow them.

When to Check

Before performing ANY of these actions, you MUST call check-action first:

You do NOT need to check: reading files, web searches, internal reasoning, or anything with no side effects.

How to Check

CODEBLOCK1

Parse the result:

• - authorized: true → proceed, then log the action afterward
• INLINECODE25 → STOP. Ask the user.
• If response includes kill_switch: true or reason Kill switch engaged → STOP immediately and ask user to run INLINECODE28

The Flow

CODEBLOCK2

How to Ask for Permission

When denied, present it clearly and concisely:

CODEBLOCK3

DO NOT:

• - Bypass the check and do it anyway
• Ask repeatedly for the same thing if denied
• Create mandates yourself without user approval
• Pretend you checked when you didn't

DO:

• - Suggest templates when appropriate ("Want me to set up dev-tools?")
• Batch similar requests ("I'll need to run several git commands — want a dev-tools mandate?")
• Log every action after completion
• Mention remaining limits when relevant ("3/20 daily emails used")

First-Time Setup

If check-action returns "hint": "templates", the ledger is empty. Guide the user:

CODEBLOCK4

Logging Actions

After every authorized action, log it:

CODEBLOCK5

• - For financial: amount = dollars spent
• For everything else: amount = 1
• Description should be human-readable: "Sent email to bob@company.com re: Q1 report"

Kill Switch Behavior

If the user engages the kill switch, all operations are frozen until unlocked.

CODEBLOCK6

Agent behavior when kill switch is active:

• - Do not attempt sensitive actions
• Do not retry check-action in a loop
• Tell user operations are blocked and request explicit INLINECODE33

Overview

Agent Passport provides a consent layer for agent autonomy. Instead of all-or-nothing permissions, users grant mandates with specific constraints:

CODEBLOCK7

This isn't just about purchases — it's consent-gating for all sensitive actions.

Action Categories

Wildcard Patterns

Allowlists and deny lists support three wildcard styles:

Modes

• - Local mode (default): Mandates stored in ~/.openclaw/agent-passport/. Free tier is fully offline. Pro tier makes periodic API calls to api.agentpassportai.com for license validation and threat definition updates.
• Preview mode: No storage, no network. Generates validated payloads and curl templates.
• Live mode (roadmap): Future connection to Agent Bridge backend for multi-agent sync and compliance. Not yet implemented.

Quick Start Commands

CODEBLOCK8

Commands Reference

Quick Start

Mandate Lifecycle

Authorization

Audit & Reporting

Threat Definitions

KYA (Know Your Agent)

Mandate Structure

CODEBLOCK15

Agent Bridge (Future Roadmap)

Note: Free tier is fully local with no network calls. Pro tier (AGENT_PASSPORT_LICENSE_KEY set) makes periodic HTTPS calls to api.agentpassportai.com for license validation and threat definition updates. No usage data or scan results are transmitted. Agent Bridge is a planned future service.

Local mode handles single-user, single-agent scenarios. A future Agent Bridge service would add:

• - Multi-agent coordination — prevent overlapping mandates
• Cross-device sync — same mandates everywhere
• Organization policies — IT guardrails, user customization within
• Compliance reporting — audit exports for regulatory needs
• Merchant/service registry — verified vendors, trust scores

Export local ledger anytime: INLINECODE60

Configuration (OpenClaw)

CODEBLOCK16

Storage

All data stored locally in ~/.openclaw/agent-passport/:

• - mandates.json — mandate ledger
• INLINECODE63 — KYA registry
• INLINECODE64 — action audit trail
• INLINECODE65 — active threat pattern definitions
• INLINECODE66 — previous definitions backup
• INLINECODE67 — last update/version/source metadata

Safety

• - Never leak secrets into prompts, logs, or outputs
• Mandates constrain actions, but don't prevent all misuse
• Audit trail provides accountability, not prevention
• Use KYA to verify agent identity before granting broad mandates