# Security and safety requirements

## Baseline

This bridge is a remote-management control plane. Treat its credentials and command path as highly sensitive.

## Required controls

- Use a dedicated MeshCentral account, never Rob’s primary administrator account.
- Grant the minimum MeshCentral permissions needed for the current phase.
- Keep the bridge on the trusted LAN or an isolated management network.
- Do not expose MeshCentral, the bridge, or an MCP endpoint directly to the public internet.
- Store secrets in a protected runtime secret store or environment file with restrictive permissions; never commit secrets.
- Use TLS for connections where supported and validate certificates appropriately.
- Authenticate and authorize every bridge request.
- Restrict targets using explicit device/group allowlists.
- Apply command allowlists or typed operations rather than accepting unrestricted shell text by default.
- Log authentication events, requests, target, operation, confirmation, result, and timestamp without logging secrets.
- Set timeouts, output limits, concurrency limits, and rate limits.
- Fail closed when the bridge, MeshCentral, or authorization state is uncertain.
- Provide a kill switch and documented rollback procedure.

## Action classes

| Class | Examples | Default policy |
|---|---|---|
| Read-only | Inventory, status, uptime, disk usage, service state | Allowed after authentication |
| Diagnostic execution | Approved health checks, log collection, connectivity tests | Targeted; explicit request; logged |
| Reversible change | Restart an approved service, create a diagnostic bundle | Immediate explicit confirmation |
| Disruptive change | Reboot, shutdown, stop service, change network settings | Explicit confirmation with impact shown |
| Destructive/high-risk | Delete files, uninstall software, disable security, arbitrary scripts | Disabled initially; separate approval/design required |

## OpenClaw-specific safety rule

Availability of a MeshCentral capability is not permission to use it. A state-changing operation requires Rob’s clear instruction and a confirmation immediately before execution. Ambiguous requests are clarification points, not authorization.

## Threat model to review

- Compromise of the bridge host or MeshCentral LXC
- Theft or misuse of the integration credential
- Prompt injection from endpoint output or device names
- Accidental targeting of the wrong device or group
- Command output containing secrets or personal data
- Replay or duplicate execution of an action
- MeshCentral/API version changes
- Network partition or partial execution across multiple targets