Everyone's raving about OpenClaw's out-of-the-box policies. They're fine for catching the low-hanging fruit, but useless for anything specific to your environment. The real power is in custom rules, and their documentation is a mess.
Here's the schema they don't tell you about. The `when` clause is key for logic, and you can chain conditions. This example checks for an S3 bucket with both public read and a missing mandatory tag.
```yaml
policy:
identifier: CUSTOM_S3_PUBLIC_UNTAGGED
name: "Public S3 bucket missing 'CostCenter' tag"
resource: aws_s3_bucket
severity: high
condition: and
conditions:
- attribute: aws_s3_bucket.acl
operator: contains
value: "PublicRead"
- attribute: aws_s3_bucket.tags.CostCenter
operator: exists
value: false
remediation: "Apply bucket policy to restrict access and add the 'CostCenter' tag."
```
Most people fail because they don't understand the attribute paths. You have to match the exact resource model from their scanner, not the generic AWS API names. Without that, your rules are silent.
Don't panic, have a rollback plan.