Public Safety Disclosure

🎯 Intended Use & Boundaries

Snapwire is an Agentic Runtime Security (ARS) platform designed to sit between AI agents and their tool-call targets. It functions as a runtime security layer (reverse proxy) that intercepts, evaluates, and enforces policy on every tool call an autonomous agent makes.

• Real-time interception and policy enforcement for AI agent tool calls
• Human-in-the-loop review queue for high-risk or ambiguous actions
• Constitutional rule engine with severity-based blocking and monitoring
• Immutable forensic audit trail of all agent decisions and delegations

Snapwire does not generate, modify, or assume responsibility for the underlying intent or output of the AI model. It operates as a passive security intermediary.

⚠ Foreseeable Misuse & Mitigation

Snapwire proactively defends against known attack vectors targeting agentic AI systems:

• CVE-2026-25253 (OpenClaw): BASE_URL redirect, credential exfiltration, domain spoofing, WebSocket hijacking, and environment variable injection are all detected and blocked by the OpenClaw safeguard engine
• Hallucination loops: The Fuse Breaker (Loop Detector) identifies and kills repetitive tool-call patterns before they drain budgets
• Prompt injection via tool parameters: Input sanitization strips injection attempts from agent-supplied parameters
• Credential theft: The Identity Vault ensures agents never see raw secrets; Snap-Tokens are used as proxies
• Unauthorized escalation: Blast Radius controls and Honeypot tripwires detect and contain rogue agent behavior

👤 Human Accountability Statement

Every action processed through Snapwire carries a chain of human accountability:

• The X-Snapwire-Authorized-By header is injected into every proxied request, creating an immutable record of which human operator authorized the agent's deployment
• The X-Snapwire-Origin-ID header traces every request back to its originating Snapwire instance
• All blocked, approved, and pending decisions are logged with timestamps, agent IDs, and operator context in the forensic audit trail
• The final Duty of Care for all agent actions and budgetary releases remains solely with the human operator

⚖ Algorithmic Discrimination Protections

Snapwire includes safeguards against algorithmic discrimination and bias in AI agent behavior:

• Constitutional Auditor: Every tool call is evaluated against a configurable set of constitutional rules that can encode equity, fairness, and anti-discrimination policies
• Equity-aware rule templates: Pre-built rule packs include data protection rules designed to prevent PII leakage and discriminatory data handling
• Observe & Audit Mode: New rules can be tested in observation mode before enforcement, preventing unintended discriminatory blocking patterns
• Community Rules: Open, peer-reviewed rule contributions ensure diverse perspectives in governance policy
• Deception Detection: Heuristic analysis identifies when agents attempt to circumvent safety rules through obfuscation or misdirection

✅ Compliance Standards

Snapwire aligns with the following regulatory and standards frameworks:

📊 Current NIST Grade

Based on installed rule packs and their mapping to NIST IR 8596 categories:

🛡 Active Safeguards

This instance currently has 22 active safeguards protecting AI agent operations:

• Constitutional Rule Engine
• OpenClaw CVE-2026-25253 Safeguard
• Loop Detector (Fuse Breaker)
• Input Sanitizer
• Blast Radius Controls
• Honeypot Tripwires
• Identity Vault (Snap-Tokens)
• Tool Safety Catalog
• Deception Detector
• Schema Guard
• Risk Index Scoring
• Thinking Token Sentinel
• Rate Limiter