Skip to main content

​
Secret Boundary

  • The OpenClaw plugin does not hold signing secrets
  • The Decision daemon process holds sensitive material:
    • SUPABASE_SERVICE_KEY
    • MASTER_MNEMONIC / signer context
    • AXON_DECISION_API_KEY (when static operator auth is enabled)
    • AXON_API_KEY_HASH_PEPPER
    • AXON_SECRETS_KEY
    • AXON_PROVIDER_SEARCH_FEEDBACK_SIGNING_KEY (when feedback publishing is enabled)

​
Deterministic Policy Gates

Before settlement, AXON enforces:
  • Wallet active check
  • Mandate presence
  • Idempotency duplicate check
  • Host/path allow/block checks
  • Task metadata requirement (require_task_metadata)
  • Per-transaction / daily / monthly spend limits (mandate.monthly_limit_usdc)
  • Per-minute rate limits (mandate.max_requests_per_minute)
  • Per-minute spend caps (mandate.max_spend_per_minute_usdc)
  • Network validation (mandate.networks whitelist)
  • Per-task/per-host 402 retry budget

​
LLM Alignment Scoring

When AXON_ALIGNMENT_LLM_ENABLED=true, alignment evaluation uses an external LLM for semantic scoring instead of the default structural (Jaccard) scorer. The LLM scorer falls back to Jaccard on failure or timeout. LLM calls are subject to AXON_ALIGNMENT_LLM_TIMEOUT_MS.

​
Provider Identity Controls

  • Provider registry match on host + path (+ optional network/asset)
  • Challenge attestation checks for destination/network/asset consistency
  • Strict mode via AXON_REQUIRE_PROVIDER_REGISTRY=true
  • Default posture is soft mode

​
Risk & Approval Controls

  • Risk scoring with escalation thresholds
  • Human approval required for escalated requests
  • Approval tokens are:
    • Short-lived (default 5 minutes)
    • Request-scoped (wallet/host/path/method/idempotency)
    • Single-consume (consumed_at guard)

​
Runtime Abuse Controls

​
Current Launch Constraints

  • Rate limiting state is process-local. Horizontal scale increases total effective throughput unless you add an external limiter.
  • Circuit-breaker state is process-local. One instance opening a circuit does not pause peer instances.
  • The public launch docs assume USDC on Base. Other networks should be treated as non-GA.

​
Forensic Integrity

  • Canonical spend request + decision + receipt persistence
  • Signed webhook delivery (X-AXON-SIGNATURE, HMAC-SHA256)
  • Claim/lease outbox dispatch (no duplicate delivery)
  • Dead-letter status after max webhook attempts

​
Hardening Checklist

Restrict Decision daemon network exposure
Rotate AXON_DECISION_API_KEY and infrastructure secrets
Keep SUPABASE_SERVICE_KEY and signer material out of logs/transcripts
Set AXON_MCP_PUBLIC_URL in live deployments so onboarding snippets never derive from caller-controlled Host headers
Monitor denial/escalation reason-code trends
Enable and monitor webhook dead-letter queue
Verify user_organizations isolation with a second test account
Ensure SUPABASE_SERVICE_KEY is never used in the frontend
Verify the daemon refuses to start when both static operator auth and platform auth are absent