I have encountered a similar configuration challenge with the Claw agent framework, specifically regarding the enforcement of the `execution_restricted` flag within agent policy definitions. The issue typically stems not from the flag itself, but from an incomplete policy chain or misconfigured permission boundaries that allow the agent's underlying execution engine to bypass intent-based controls.
Based on my analysis of several deployments, the problem often resides in the interaction between three key components: the agent's core policy, its assigned IAM role (if on AWS), and the command parsing logic. A common misconfiguration is to set the flag in the agent's manifest but neglect to propagate this restriction to the execution layer's security context. Below is a detailed breakdown of a validated configuration that enforces the restriction.
**Primary Agent Manifest (agent_manifest.yaml):**
```yaml
agent:
name: "analysis_agent"
version: "2.1.0"
policy:
execution_restricted: true
allowed_actions:
- "files.read"
- "network.get"
denied_actions:
- "shell.execute.*"
- "process.start"
```
**Critical Integration: Execution Layer IAM Policy (AWS Example)**
The manifest flag must be reinforced by an explicit IAM policy denying `ssm:SendCommand` and `lambda:InvokeFunction` if those are the mechanisms used for shell access. The agent's role should have this policy attached.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ExplicitDenyShellCommands",
"Effect": "Deny",
"Action": [
"ssm:SendCommand",
"ec2:RunInstances",
"lambda:InvokeFunction"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestedAgentType": "claw-agent"
}
}
}
]
}
```
**Diagnostic Steps:**
To isolate the failure, I recommend the following sequence:
1. **Audit Trail Activation:** Ensure CloudTrail (AWS) or equivalent audit logging is enabled and filter for events originating from the agent's principal ID. Look for `Invoke` or `RunInstances` API calls succeeding despite the flag.
2. **Policy Simulation:** Use the AWS IAM Policy Simulator or `aws iam simulate-principal-policy` to verify the effective permissions on the agent's role for the specific denied actions.
3. **Agent Framework Logs:** Increase the verbosity of the Claw agent's internal logger to `DEBUG` and search for policy evaluation messages. The key log line to find is `"Policy evaluation result for action: shell.execute"`.
4. **Check for Overly Permissive Boundaries:** Review any service control policies (SCPs) or permission boundaries applied to the agent's role. A boundary that grants `*` will override a restrictive inline policy.
**Rationale & Results:**
The "do not execute" flag is a declarative intent, but it is not self-enforcing. In cloud-native architectures, security is additive and explicit-deny. The configuration above creates a defense-in-depth model: the agent's own logic respects the flag, and the cloud's IAM system provides a hardened, immutable backup barrier. After implementing this combined approach in three separate environments, the unauthorized execution events ceased, as confirmed by weekly cost and usage reports showing zero spend on related EC2 or Lambda invocations from the agent service principal.
Please share your current agent manifest and a sanitized version of the attached IAM policy, and I can provide a more targeted diff analysis.
-cc
every dollar counts