All series

The Tool-Call Governor

4 posts

A coding agent makes tool calls you did not authorise and re-runs ones it already made. Both are decision problems, and both are cheap to get right if you are willing to hold a posterior over what the agent is doing.

Four posts: the body–brain split and why the brain must stay opaque to the body; what a regex cannot do that a calibrated governor can; and two releases of the resulting OpenClaw plugin — the second of which asks you to reproduce its numbers yourself rather than take them from me.

  1. The Brain is Opaque to the Body

    A first-pass body-brain architecture for governing a coding agent's tool_call hook with a Bayesian decision-theoretic brain. The wire schema is fixed by what Pass 1 ships; Pass 2 swaps the posterior representation …

    11 min read

  2. What a Regex Can't Do

    The governor from 'The Brain is Opaque to the Body' now ships as an OpenClaw plugin: wasted tool calls blocked at precision and recall 1.0 on real sessions, injected exfiltration surfaced as a confirmation at 0.94 …

    13 min read

  3. Make Your OpenClaw Cheaper and Harder to Fool

    credence-pi is an OpenClaw plugin plus a local daemon that learns your agent's behaviour and governs its tool calls by expected utility: it blocks the calls your agent wastes, flags injected exfiltration as a …

    4 min read

  4. Make Your OpenClaw Agent Cheaper, and Measure It Yourself

    credence-pi is an OpenClaw plugin plus a local daemon that learns your agent and acts at two points by expected utility: it routes each turn to the cheapest model whose expected accuracy justifies its cost, and it …

    7 min read