openclaw-hardening

"agents": {
  "defaults": {
    "sandbox": {
      "mode": "all",          // sandbox everything
      "scope": "session",     // per-session isolation (best security)
      "workspaceAccess": "none"  // no access to your files
    }
  }
}```