Security & guardrails
Least-privilege service permissions, LLM isolation, credential handling, and the immutable audit log.
Security in Clawlas is structural — keys, registries, isolation and least privilege — not a matter of prompting. Each service holds only the credentials it needs, and LLM output is treated as untrusted.
Service permissions (least privilege)
| Service | Credentials it gets |
|---|---|
| Collectors | Read-only API keys where necessary |
| Agents | LLM credentials only — no exchange secrets |
| Execution engine | Exchange trading credentials (isolated network) |
| Frontend | No private service secrets |
LLM isolation
An LLM must never directly:
- execute shell commands or write production strategy files;
- query secrets or submit exchange orders;
- modify risk limits.
Tool calls pass through allowlists, schema validation, authorization and deterministic handlers. The surface widens by adding tools, never by the model itself.
Credentials
Exchange API keys are handled by code, never by the model:
- never stored in Convex, in agent prompts, or in logs;
- trading permissions only, withdrawals disabled, IP-restricted where supported;
- mounted only into the execution service — agents have no access.
No-real-money key during research
Through shadow mode and simulation, the system uses a no-real-money key: even a fully compromised agent cannot place an order or withdraw funds. The production phase switches to a trade-only key with an IP allowlist — never withdrawals.
Immutable audit log
Audit records (append-only) cover strategy changes, human approvals, score changes, model changes, order instructions, exchange responses, manual interventions and emergency actions. VITE_-prefixed env vars are public; secrets live in Docker secrets or encrypted files and are injected at deploy.