BuildWithHQ
Canonical knowledge unit · goclaw

GoClaw secure context assembly

Before planning, GoClaw assembles a bounded context package from the Inbox source and permitted records, relationships, activity, conversations, files, calendar, knowledge, and secured RAG under one authorization envelope.

ID: BWHQ-GOCLAW-003Status: specifiedAuthority: highgoclawcontextragrecord-graphpermissions

GoClaw secure context assembly

Context assembly

GoClaw context is not a broad scrape of tenant data. It is assembled under the acting identity’s resolved permissions and may include the Inbox source, record graph, activity chain, conversations, files, calendar data, knowledge, and RAG results that are individually permitted.

AI rule

The model receives an already-permitted context set. Prompt instructions are not the security boundary.

Freshness

Context should carry the relevant Inbox ActivityVersion or equivalent freshness marker so later approval/execution can detect whether the business context changed after planning.

Related knowledge

GoClaw Universal Inbox claim loopGoClaw work is intended to enter through the Universal Inbox, where eligible items are claimed, leased, heartbeated, and released under user/role permissions instead of being handled through a direct ungoverned inbound shortcut.Permission-aware RAGBuildWithHQ resolves the caller’s allowed data envelope before semantic retrieval returns context to the model; prompt text is not treated as the security boundary.Universal Record modelImportant application objects share a universal RecordId so records, relations, security, search, AI, audit, favorites, and workflows can operate across modules.
Machine-readable source: canonical Markdown. This HTML companion exists for human reading, search indexing, and AI retrieval.