The OpenClaw Gateway is not the brain: who decides, who acts
By Christophe Paka · Facts checked on 7 November 2026
Your assistant gave a poor answer, or did something you did not expect. So you open the config and start changing the Gateway. Or you switch to a smarter model and hope it is now safer.
Both moves fix the wrong thing. One leaves the answers weak; the other leaves the risky actions open.
The OpenClaw Gateway holds the keys, and the model only tells it what to do. The figure below draws that split inside one program.
How to read this figure
The big box is one program. The outer box is the Gateway process: one program on your machine. The small print under its name is its address,
127.0.0.1:18789. The part before the colon is localhost, the name a computer uses for itself. The part after it is the port, the door number the Gateway listens at. So by default only this computer can talk to it. Keep it that way.Agent reasoning asks the model. The left box, Agent reasoning, is the agent: one configured assistant with its own model, folder and set of actions. It sends text to the model provider and gets back a plan. The model only reads that text and writes what to do.
The arrow is the hand off. The plan crosses to the right box. From here on the Gateway acts, not the model. The model never touches your machine, so a better model cannot stop a bad action.
Tools do the work. A tool is a built in action the Gateway runs for the agent. The figure names five groups. Exec runs commands, filesystem reads and writes files, browser drives a web browser, web searches and fetches pages, and media is the fifth. The book's morning brief switches off exec and the browser, and keeps file reading and web search.
Read the small print. The tools are sandboxed, meaning run in a separate container apart from your files, only if you turn that on. Until then they reach what the Gateway reaches. The lethal trifecta shows the mix of access that makes this risky.
Key takeaways
- Fix weak answers with a better model, because the Gateway only runs what the model plans.
- Fix risky actions with stricter Gateway rules, because a smarter model does not make it safer.
- Start with one agent, and add a second only when a job needs different rights.
Worked example: one Gateway, two agents
You run a morning brief, then want a bot for a family group chat. Here is how the split between model and Gateway plays out.
- Agent one is the brief: one model, one folder of files, and two actions, read a file and search the web.
- Agent two is the family bot. It gets its own model and its own allowed actions, and it may not run commands.
- Your sister asks the family bot to search the web. The model plans a search, and the Gateway runs it.
- She asks for a reminder every day at 6. The Gateway refuses, because only the owner may set timed jobs.
- Both agents live in one Gateway, and by default they can read each other's chats and message each other. The book narrows that with two settings,
tools.sessions.visibilityandtools.agentToAgent.
Result: The model plans the same way for both agents. What each one may do is set in the Gateway, agent by agent.
Questions readers ask
Does a better model make OpenClaw safer?
No. The model only decides; the Gateway holds the keys and acts. Safety comes from what the Gateway allows: which tools are on, what they can reach, and whether they run in a sandbox. A smarter model gives better instructions. A stricter Gateway refuses bad ones.
What port does the OpenClaw Gateway use?
By default it listens at 127.0.0.1:18789. That address is localhost, so only the same computer can talk to it. The Control UI, the Gateway's own web page for settings, chats and approvals, opens at the same address. Keep it off the internet.
Are OpenClaw tools sandboxed by default?
No. The tools run with the Gateway's own rights until you switch the sandbox on. The setting is agents.defaults.sandbox, and its mode is off by default. Set it to all and every session's tools run in a separate container, apart from your files. The book's hardening chapter adds the workspace read only, so the brief can still read its notes.
Sources: Tools and capabilities (OpenClaw docs); Gateway operations (OpenClaw docs); Security and the safety model (OpenClaw docs).
This figure is from OpenClaw Made Crystal Clear, chapter 2.
The chapter builds the idea step by step, with recipes you can follow, a Try it to check yourself, and every source.
Get the book
