{"slug": "openbot-writes-the-audit-row-before-an-allowed-computer-action-runs", "title": "OpenBot writes the audit row before an allowed computer action runs", "summary": "OpenBot, an alpha-stage open-source agent governance template, routes every computer, file, MCP server and component action through a single gateway that evaluates CEL policy and writes an audit row before the action executes, so no action can occur without a prior record. The README states the project is \"a template, not a product,\" with no hosted version or published package, and requires operators to replace the example tenant package under examples/ with their own coworkers, channels and skills.", "body_md": "A key line in the OpenBot README is about ordering. When a Bot acts on its computer, the gateway resolves the target from a server-held snapshot, evaluates the policy, writes the audit row, and only then calls the computer. In the README's words, there is no path that acts without the record existing first.\n\nThe tagline says every action is \"decided before it happens and recorded after.\" The Features section is more specific, and the specifics locate that trust claim in the single gateway used for computer, file, MCP server and component actions.\n\nAnything a Bot does to a computer, a file, an MCP server or a component \"goes through one gateway that decides and records it,\" and the README frames that as the difference between an agent that can use your tools and an agent you can let near them.\n\nThe decision step uses CEL policy. Rules can inspect `tool.name`, `intent`, `bot.id`, `actor.id`, `page.url`, `page.host`, `element.*`, `key`, `file.*` and `mcp.*`. Deny is evaluated before allow, a missing policy permits nothing, and a broken rule refuses rather than opens. The README calls this fail closed. When the gateway refuses, it names the rule that did it.\n\nShell commands pass through the same gate. A Bot can run commands in its workspace and install what it needs, and a rule can refuse a shell outright or refuse particular commands, and the command is on the record either way. It inherits PATH, locale, terminal and proxy variables, not the rest of the deployment's environment.\n\nThe README limits what the trail records when a Bot requests a secret. The trail records that a secret was requested and how long it was, not what it said. The Activity tab shows what a Bot ran, read and saved, with the output, but a saved file shows its path and size rather than its contents. Administrators review permitted, refused and failed actions at `/admin/audit`.\n\nHuman intervention lands in the record too. A Bot that hits a login wall or a 2FA prompt asks for help, and control is handed over in the same panel, logged as `computer.help_requested`, `computer.control_taken` and `computer.control_released`. While a person is driving, Bot actions are refused rather than queued. That detail is easy to skim past.\n\nThe supervisor gives each Bot its own container, its own `/workspace` volume and its own browser profile, so logins belong to one coworker. Setting `COMPUTER_RUNTIME=runsc` runs those containers under gVisor where the host supports it.\n\nBots arrive over AG-UI, so an agent built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or by hand arrives the same way. The governance rides the protocol rather than the framework. Endpoints you bring are validated with the same target checks used for browser navigation, and their auth header is stored write-only. MCP follows suit: Google Drive and Notion ship in the catalogue, reached as the person asking, custom servers must pass URL checks, and unknown tools and custom-server tools are treated as writes.\n\nOpenBot is candid about what it is. The README calls it \"a template, not a product.\" There is no hosted version, nothing is published as a package to depend on, and you are expected to replace the example tenant package under `examples/` with your own coworkers, channels and skills. It is also marked alpha, with rough edges and moving parts expected.\n\nThe default configuration deserves a look. `.env.example` sets `OPENBOT_SINGLE_USER=true`, which admits every request as one administrator so a fresh clone works without registering an OAuth client. Sign-in turns that off, and the README says it is required before anybody else can reach the deployment.\n\nThe README's own walkthrough shows the gateway: ask a Bot at `/bot` to fill out a test form, inspect `/admin/audit`, then add a deny rule or preset at `/admin/boundaries` and retry the same browser action. Running it locally takes Docker, Bun 1.3 or later, a CopilotKit Intelligence project and a model key, and `scripts/start.sh` starts the services, applies migrations and checks health routes before printing next steps.\n\n**GitHub:** [https://github.com/CopilotKit/OpenBot](https://github.com/CopilotKit/OpenBot)\n\n*Curated by [Agent Palisade](https://www.agentpalisade.com) — practical AI for small and mid-sized businesses.*", "url": "https://wpnews.pro/news/openbot-writes-the-audit-row-before-an-allowed-computer-action-runs", "canonical_source": "https://dev.to/renolu/openbot-writes-the-audit-row-before-an-allowed-computer-action-runs-cl7", "published_at": "2026-09-18 16:49:02+00:00", "updated_at": "2026-09-18 16:52:59.298546+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "agent-protocols", "developer-tools", "ai-tools"], "entities": ["OpenBot", "CEL", "gVisor", "AG-UI", "LangGraph", "Mastra", "CrewAI", "Google ADK"], "alternates": {"html": "https://wpnews.pro/news/openbot-writes-the-audit-row-before-an-allowed-computer-action-runs", "markdown": "https://wpnews.pro/news/openbot-writes-the-audit-row-before-an-allowed-computer-action-runs.md", "text": "https://wpnews.pro/news/openbot-writes-the-audit-row-before-an-allowed-computer-action-runs.txt", "jsonld": "https://wpnews.pro/news/openbot-writes-the-audit-row-before-an-allowed-computer-action-runs.jsonld"}}