Evidence record / openclaw
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-openclaw-main-warns-when-mutable-sender-names-select-privileged-tool-policies
Main warns when mutable sender names select privileged tool policies. A room member can change a display name or handle to match a name: or username: tool-policy override intended for someone else. Main adds toolsBySender.mutable_entries warnings and recommends stable id: keys. It keeps mutable keys supported and does not change their matching semantics. This is a sender-key warning, separate from section 14’s room-name/channel-ID repair.
Channel: main-unreleased. Half: defect. Date: 2026-10-15.
Operator consequence: Inspect privileged toolsBySender keys now and replace mutable name/username selectors with stable IDs. Current stable and beta do not supply the warning, and a future warning will still require an owner to correct configuration.
Receipt
- https://github.com/openclaw/openclaw/commit/16a3787ba105b71a72843941dcdf1c78634b752c
- https://github.com/openclaw/openclaw/blob/v2026.10.7/docs/gateway/config-tools/tool-policy.md#L230-L248
- https://github.com/openclaw/openclaw/blob/v2026.10.7/src/security/audit-channel.ts
- https://github.com/openclaw/openclaw/blob/v2026.10.10-beta.3/src/security/audit-channel.ts
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-openclaw-main-warns-when-mutable-sender-names-select-privileged-tool-policies
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-openclaw-main-warns-when-mutable-sender-names-select-privileged-tool-policiesgithub.com/openclaw/openclaw/commit/16a3787ba105b71a72843941dcdf1c78634b752ctagged commit file2026-10-24-openclaw-main-warns-when-mutable-sender-names-select-privileged-tool-policiesopenclaw/openclaw / docs/gateway/config-tools/tool-policy.md#L230-L248tagged commit file2026-10-24-openclaw-main-warns-when-mutable-sender-names-select-privileged-tool-policiesopenclaw/openclaw / src/security/audit-channel.tstagged commit file2026-10-24-openclaw-main-warns-when-mutable-sender-names-select-privileged-tool-policiesopenclaw/openclaw / src/security/audit-channel.ts
Versioned source: run artifact