Security
An overview of security measures implemented in the KorClaw platform.
KorClaw is a runtime compliance layer for AI agents. Security is built into governance workflows — not added as an afterthought. This page summarizes protections that are implemented in the product today.
Workspace isolation
API keys, agents, policies, MCP servers, audit logs, and approvals are scoped to a single workspace. Cross-workspace access is not available through the API.
Agent identity
Agents can require a cryptographic key on runtime and policy requests. Workspace settings can require verified agent identity before actions are evaluated or executed.
Policy enforcement
Governed actions run through policy evaluation before execution. Blocked actions are denied at runtime, and workspaces can require the execution proxy for tool and resource actions.
Audit logging
Policy evaluations, executions, MCP calls, and approval decisions are recorded for review and export. Audit ingestion can be configured to fail closed when logging is unavailable.
For implementation details, see the security documentation. To report a vulnerability, contact founder@korclaw.com.