Overview

The Swif OpenClaw Tools Experimental Policy manages experimental built-in OpenClaw tool features on enrolled devices.

The current policy contains one setting, Plan Tool, which controls access to OpenClaw's multi-step work-planning feature on compatible OpenClaw gateway versions. The planning tool lets an agent maintain a structured status record for longer tasks so users and administrators can see which steps are pending, in progress, or completed.

The policy supports:

macOS
Windows
Linux
Company-owned devices
BYOD devices

Important: OpenClaw has changed this feature in newer releases. Older versions used tools.experimental.planTool and exposed an update_plan tool. Current OpenClaw documentation uses tools.updatePlan and presents the feature as progress_card. Confirm compatibility with the installed gateway version before assigning this policy broadly.

What the Plan Tool Does

When supported and enabled, the planning tool helps an AI agent organize non-trivial work into visible steps. The agent can update the plan as work progresses and identify the current in-progress step.

Typical uses include:

Tracking a multi-file development change
Showing progress during a longer investigation
Recording pending, active, and completed work
Keeping a user informed while an agent performs several dependent actions
Providing a concise status summary for complex work

The planning feature records and displays progress. It does not independently execute commands, edit files, browse the web, contact external services, or grant access to another tool.

Any action referenced by the plan still requires permission under the Swif OpenClaw Tools Access Policy, the OpenClaw runtime, and the operating system.

Requirements

Requirement	Details
Swif access	An active Swif workspace and an administrator with permission to create and assign policies
Supported platforms	macOS, Windows, and Linux
Device ownership	Company-owned and BYOD devices
Device management	The target device must be enrolled in Swif Agentic Security
OpenClaw	The OpenClaw gateway must be installed on the device
Version compatibility	The installed gateway must recognize the configuration key delivered by the policy
Tool access	The applicable OpenClaw tool profile and allow or deny rules must permit the planning tool
Connectivity	The device must be online to receive a new or updated policy

This policy does not install the OpenClaw gateway or the Swif Agentic Security agent.

Version Compatibility

OpenClaw's planning feature has evolved:

OpenClaw configuration generation	Configuration and tool behavior
Older releases	Used `tools.experimental.planTool` and referred to the tool as `update_plan`
Current releases	Use `tools.updatePlan` as the feature switch and present the tool as `progress_card`

Current OpenClaw documentation states that:

tools.updatePlan is enabled by default for tool-capable providers and models.
Setting tools.updatePlan to false hides progress_card from every run.
New access policies should use the progress_card tool ID.
Existing allow or deny rules naming update_plan are mapped for compatibility.
openclaw doctor --fix can migrate the older tools.experimental.planTool configuration to tools.updatePlan.

The current Swif policy definition uses the older Plan Tool model. Therefore, behavior can depend on the installed OpenClaw version.

Compatibility notice: A successful Swif policy status confirms that the policy was delivered. It does not prove that the installed OpenClaw version recognized the legacy setting. Always perform the functional verification described below.

Do not run an automated configuration migration across managed devices without first confirming how Swif will reapply the policy. A local migration can be overwritten if the management policy continues to deliver the older key.

Recommended Configuration

The Swif policy default is:

Setting	Default value
Plan Tool	Disabled

Keep Plan Tool disabled unless users need visible multi-step work tracking and the installed OpenClaw version has been validated with this policy.

When the feature is required:

Assign the policy to a small pilot group.
Set Plan Tool to Enabled.
Confirm the gateway version and effective configuration.
Start a new OpenClaw session.
Run a harmless multi-step test task.
Confirm that the planning tool is available and updates correctly.
Expand the assignment only after testing succeeds on every managed platform and gateway version.

Policy Setting

Plan Tool

Controls the OpenClaw multi-step planning feature on compatible gateway versions.

Value	Behavior
Enabled	Requests that the compatible OpenClaw gateway enable the planning tool for multi-step work tracking. The applicable tool access policy must still permit the tool.
Disabled	Requests that the compatible OpenClaw gateway disable the planning feature. This is the Swif policy default.

Enabling this setting does not:

Grant command-execution access
Grant filesystem access
Permit tools denied by another policy
Enable elevated execution
Enable agent-to-agent access
Change session visibility
Install OpenClaw or Agentic Security
Guarantee compatibility with a newer gateway that no longer uses the legacy key

Interaction With the Tools Access Policy

The experimental policy controls whether the planning feature is enabled. The Swif OpenClaw Tools Access Policy controls whether the agent may use the corresponding tool.

Both layers must permit it.

For current OpenClaw releases:

Use progress_card in new tool allowlists or denylists.
The coding profile includes the planning tool.
group:agents includes progress_card along with other agent and goal-management tools.
A matching deny rule prevents access even when Plan Tool is enabled.

If the Tools Access Policy uses the minimal profile, add progress_card explicitly when planning is required. Avoid allowing the entire group:agents group unless the agent needs every capability in that group.

Older policies that reference update_plan may continue to work through OpenClaw's compatibility mapping, but use progress_card for new configurations.

Create the Policy

Sign in to the Swif Admin Console.
Go to Agentic Security > Policy Management.
Select Create new policy.
Start from scratch and select Swif OpenClaw Tools Experimental Policy.
Enter a descriptive policy name, such as:
```
Enable OpenClaw Multi-Step Planning
```
Set Plan Tool to Enabled or Disabled.
Assign the policy to a test device or pilot device group.
Review the configuration and finish creating the policy.
Allow the device to check in and apply the policy.

For the general assignment workflow, see Assigning policies to devices or groups.

Configuration Examples

Enable Planning for a Managed Coding Agent

Use this configuration when developers need visible progress tracking for longer coding tasks.

Policy	Setting	Value
Swif OpenClaw Tools Experimental Policy	Plan Tool	Enabled
Swif OpenClaw Tools Access Policy	Tool Profile	`coding`
Swif Agentic Security Logging Policy	Enabled	Enabled

The Tools Access Policy can still deny unrelated high-risk capabilities such as runtime execution or filesystem mutation. Planning does not require unrestricted device access.

Permit Planning With a Minimal Tool Profile

Use this configuration when an agent should track progress but receive very limited operational access.

Policy	Setting	Value
Swif OpenClaw Tools Experimental Policy	Plan Tool	Enabled
Swif OpenClaw Tools Access Policy	Tool Profile	`minimal`
Swif OpenClaw Tools Access Policy	Allowed Tools	`progress_card`
Swif OpenClaw Tools Access Policy	Elevated Exec	Disabled
Swif OpenClaw Tools Access Policy	Agent To Agent	Disabled

For an older gateway, verify whether its access policy still expects the legacy update_plan name.

Disable the Planning Feature

Setting	Value
Plan Tool	Disabled

Use this configuration when visible planning is not required, when the feature has not been approved, or while investigating compatibility with an OpenClaw upgrade.

Verify the Policy

After deployment:

Confirm that the target device is online in Swif.
Open the policy deployment report.
Confirm that the policy reports as successfully applied.
Confirm that the OpenClaw gateway is installed and running.
Record the installed OpenClaw version.
Start a new OpenClaw session after the policy is applied.
Give the agent a harmless task containing several dependent steps.
Confirm that a progress card or structured plan appears when Plan Tool is enabled.
Confirm that the agent updates the plan as each step progresses.
Set Plan Tool to Disabled, redeploy to the test device, start another new session, and confirm the feature is unavailable if disabled behavior must also be validated.

A suitable test task is:

Create a three-step plan for reviewing a temporary test folder, summarize its file types, and report completion without modifying any files.

Do not use production data, credentials, destructive commands, or external communications for feature testing.

Privacy and Security Considerations

A progress card can contain task names, filenames, project descriptions, implementation steps, or other work context. Treat plan content as part of the organization's AI-agent activity record.

Before enabling the feature:

Tell users when managed AI-agent activity is monitored.
Avoid placing credentials, secrets, personal information, or regulated data in plan text.
Restrict access to Agentic Security and OpenClaw activity records.
Apply appropriate retention and incident-response procedures.
Enable Agentic Security logging when an audit record is required.
Keep tool permissions separate and limited to the approved workflow.

The plan describes intended work. It is not proof that an action succeeded, that a security control was applied, or that every planned step was safe.

Troubleshooting

The Policy Reports as Applied but No Planning Tool Appears

Check the following:

Plan Tool is set to Enabled.
The device received the latest policy version.
The OpenClaw gateway is installed and running.
A new session was started after the policy changed.
The installed OpenClaw version recognizes tools.experimental.planTool or migrates it correctly.
The Tools Access Policy permits progress_card or the applicable legacy tool name.
A global, provider, sender, sandbox, or agent-specific deny rule is not blocking it.
The selected provider and model support tool use.

Review the current OpenClaw tools configuration documentation for the configuration expected by the installed release.

The Planning Tool Appears Even Though the Policy Is Disabled

Current OpenClaw versions enable tools.updatePlan by default. If Swif delivers only the older experimental key, disabling Plan Tool might not disable progress_card on a newer gateway.

Also check for:

A local tools.updatePlan setting
Another assigned policy
A per-agent configuration override
A gateway migration that retained the newer key
A session that started before the policy changed

If this occurs consistently on the current gateway release, contact Swif Support with the policy status, operating system, OpenClaw version, and a sanitized copy of the effective configuration.

The Planning Tool Disappeared After an OpenClaw Upgrade

The gateway may have stopped reading the legacy experimental configuration.

Confirm whether the installed version now expects:

tools.updatePlan

OpenClaw documents openclaw doctor --fix as a migration path from the legacy key. On a Swif-managed device, coordinate the migration with your administrator or Swif Support so the old managed value is not repeatedly reapplied.

The Agent Can Plan but Cannot Perform a Step

This can be expected. Planning access does not grant the tools required to perform the planned work.

Review the Swif OpenClaw Tools Access Policy for:

Tool profile
Allowed Tools
Denied Tools
Provider Tool Policy
Sender Tool Policy
Sandbox Tool Policy
Elevated Exec
Agent To Agent
Sessions Visibility

Grant only the missing capability required for the approved workflow. Do not switch to an unrestricted profile merely to make a test pass.

The Agent Creates a Plan for a Simple Task

The planning tool is intended for non-trivial work. Whether the agent uses it can depend on the model, prompt, and tool description.

Ask the agent to use planning only when a task has multiple meaningful steps. Enabling the tool makes it available; it does not require the agent to use it for every request.

Disable or Remove the Policy

To disable the feature explicitly:

Open the Swif OpenClaw Tools Experimental Policy.
Set Plan Tool to Disabled.
Save and redeploy the policy.
Allow the device to check in.
Start a new OpenClaw session.
Confirm that the planning tool is no longer available on the tested gateway version.

Disabling the feature does not remove previously created plans or activity records.

Removing the policy assignment is not the same as explicitly disabling the feature. The device can retain a locally configured or previously applied value, and current OpenClaw versions may enable tools.updatePlan by default. Deploy and verify the intended disabled state before removing management.

Summary

The Swif OpenClaw Tools Experimental Policy controls OpenClaw's multi-step planning feature on macOS, Windows, and Linux devices.

For a reliable deployment:

Confirm the installed OpenClaw version.
Validate whether it uses the legacy experimental setting or the current tools.updatePlan setting.
Enable Plan Tool only on a pilot device first.
Permit progress_card through the Tools Access Policy when required.
Start a new session and verify actual planning behavior.
Enable Agentic Security logging when audit visibility is required.
Revalidate the policy after every OpenClaw upgrade.

Swif OpenClaw Tools Experimental Policy