# OpenClaw Governance, Audit Log & Cost X-Ray — Install Guide

Govern OpenClaw in one command. A native governance plugin logs, scopes, and prices every tool call — full audit trail, deny-by-default policy, and per-user attribution. Free up to 5 agents.

# Govern OpenClaw with Agentic Control Plane

<p style="font-size:17px;line-height:1.6;color:var(--acp-text);max-width:660px;margin:8px 0 6px;">See, control, and price <strong>every tool call OpenClaw makes</strong> — the shell commands, the file edits, the model calls — from one dashboard. One command, no code changes, first governed call in about 30 seconds.</p>

## TL;DR

```bash
curl -sf https://agenticcontrolplane.com/install.sh | bash
```



The installer detects OpenClaw (`command -v openclaw`) and installs the ACP governance plugin, then opens your browser to provision a workspace. Restart OpenClaw and every tool call is governed. Prefer to do it by hand? It's one plugin:

```bash
openclaw plugins install @gatewaystack/acp-governance
```

## How it works

OpenClaw ships a first-class plugin system. ACP's governance plugin (`@gatewaystack/acp-governance`) registers into it and routes every tool call through the Agentic Control Plane before and after execution:

- **Before the call** — the plugin sends the tool name and input to ACP's policy engine (`/govern/tool-use`). The server evaluates the full pipeline — immutable rules, delegation chain, scopes, ABAC, rate limits, plan limits, content scanning — and returns `allow` / `deny` / `ask`. A `deny` blocks the call before it runs; the agent sees the reason and adapts.
- **After the call** — the plugin forwards the result for audit and content scanning (PII, secrets, prompt-injection findings). The call, its decision, its identity, and its cost land in your ACP activity log.

Same backend, same dashboard, same three-axis policy model as every other client — the plugin is just how it wires into OpenClaw's runtime instead of Claude Code's shell hooks or Codex's config.

## What gets installed and where

| Path | Purpose |
|---|---|
| OpenClaw plugin directory | `@gatewaystack/acp-governance` — the governance plugin |
| `~/.acp/credentials` | Bearer token from browser OAuth (`chmod 600`) |

No system-level writes. The plugin authenticates with the ACP key in `~/.acp/credentials`, so credential rotation is a one-step overwrite — no plugin reinstall. Uninstall is `openclaw plugins remove @gatewaystack/acp-governance`.

## Add the cost X-ray

The plugin governs and audits **tool** calls. To also meter model spend — per-call token cost, prompt-cache hit rate, and the loop-vs-leaf cost X-ray — route OpenClaw's model calls through the ACP proxy: point its model endpoint at `https://api.agenticcontrolplane.com/v1` (OpenAI-compatible) and authenticate with your ACP key (`gsk_...`). Same responses, now metered — and the proxy governs the tool-use blocks the model emits as a second layer.

Full walkthrough: [Turn on Cost X-Ray](/cost-tracking).

## Setting up policy

The same three-axis model applies (Tool / Agent / User policies). Start in **audit mode** for a few days to learn what your OpenClaw agents actually do, then switch to **enforce mode** once the patterns are clear. Most-restrictive-wins on conflict.

## Related integrations

- [Claude Code](/integrations/claude-code) — shell-hook governance, same backend contract
- [OpenAI Codex CLI](/integrations/codex) — hooks + MCP connector
- [Cursor](/integrations/cursor) — Composer-hook governance, no Enterprise plan needed
- [Hermes Agent](/integrations/hermes) — native Python plugin, same idea for a different runtime