Audit and control — brainclaw

When a session went sideways — three agents touched the same week, one of them ran a security tool you didn’t ask for, the diff is 800 lines and you can’t tell who changed what — you want one place to look. brainclaw writes every state mutation to an append-only audit log: actor, action, before/after, scope, session id, timestamp. JSONL, in your repo, no cloud round-trip.

# Read the audit trail (last 100 entries)
brainclaw audit --limit 100

# Roll memory back to a previous Git ref (without losing the audit history)
brainclaw memory-rollback abc1234

You can also gate what an agent is allowed to touch before it edits. Trust levels (observer | contributor | trusted | curator) tier capabilities. Policy checks block sensitive scopes via glob patterns at claim time. Pre-merge security scans surface package risks before they ship.

# Policy gating is implicit at claim time in 1.10 — bclaw_work
# runs the same policy checks before opening the claim, so a
# sensitive scope is blocked at the boundary you actually use.
bclaw_work intent=execute scope="src/secrets/" task="rotate token"
# → BLOCKED: glob src/secrets/** requires trust=curator

The standalone bclaw_check_policy tool is deprecated; the same engine now runs implicitly inside bclaw_work at claim time.

Three layers, one mental model: trust (who can do what), policy (when), audit (what actually happened). All readable, all rollback-able, no proprietary log format.

Analytics only if you say yes.