OpenBot writes the audit row before an allowed computer action runs

The OpenBot documentation emphasizes the importance of a specific order when a Bot acts on a computer. According to the README, the gateway resolves the target from a server-held snapshot, evaluates the policy, writes the audit row, and only then calls the computer. This ensures that every action is decided before it happens and recorded after.

The Features section further explains that this single gateway is responsible for all actions involving computers, files, MCP servers, and components. Regardless of the type of action, it all goes through this one gateway that decides and records it. The decision step utilizes CEL policies, which specify rules to inspect various parameters such as tool.name, intent, bot.id, actor.id, page.url, page.host, element.*, key, file.*, and mcp.*.

If a deny rule is encountered, the process is halted, and the specific rule responsible is named. This fail-closed approach ensures that nothing is permitted if no policy exists or if a broken rule is identified. Shell commands can also pass through the same gate, with the Bot being able to run commands in its workspace and install necessary tools.

The rules can refuse individual commands as well, ensuring accountability for each action taken. Regarding the audit trail, the documentation notes that only specific information is recorded when a Bot requests a secret. While the trail records the request and duration, it does not reveal the secret itself. The Activity tab provides details on what actions were run, read, and saved, including the output.

However, saved files display only their path and size, omitting the actual content. Administrators can review permitted, refused, and failed actions through the /admin/audit endpoint. Additionally, human intervention, such as login walls or 2FA prompts, also triggers the creation of log entries like computer.help_requested, computer.control_taken, and computer.control_released.

The documentation highlights that while Bot actions are refused during human intervention, it is crucial to pay attention to this detail as it is often overlooked. Each Bot operates within its own container, with a dedicated /workspace volume and browser profile. This isolation ensures that user logins belong to individual users.

The OpenBot supervisor runs containers under gVisor when COMPUTER_RUNTIME=runsc is set, providing an additional layer of security. Bots can be deployed using various agents built with different frameworks or languages, all following the same protocol for governance. The endpoints, whether built with frameworks like LangGraph, Mastra, CrewAI, Pydantic AI, or Google ADK, or crafted manually, undergo validation through the same target checks used for browser navigation.

Moreover, the authentication header for these endpoints is stored write-only to maintain security. OpenBot recognizes the importance of thorough consideration before deployment. The README clearly states that OpenBot is a template rather than a fully-fledged product. It is not hosted, and users are expected to replace the example tenant package in examples/ with their own coworkers, channels, and skills.

The software is currently marked as alpha, indicating that rough edges and moving parts are expected. The default configuration is worth reviewing, as the .env.example file sets OPENBOT_SINGLE_USER=true, allowing for a fresh clone to function without registering an OAuth client. However, sign-in is required to enable access for other users.

The documentation provides a walkthrough demonstrating the gateway by instructing users to interact with a Bot through /bot to fill out a test form, inspect /admin/audit, and then add a deny rule or preset at /admin/boundaries before retrying the same browser action. To run OpenBot locally, Docker, Bun 1.3 or later, a CopilotKit Intelligence project, and a model key are required.

The scripts/start.sh script simplifies the process by starting the services, applying migrations, checking health routes, and providing next steps. For more information, users can visit the GitHub repository at https://github.com/CopilotKit/OpenBot.