The post Celebrating Southern Nevada’s Technology Leaders: 2026 Top Tech Awards Nominations Are Open appeared first on Joshua Bellendir.

The basic architecture is:

• Twilio provides the phone number and call transport.
• OpenClaw runs the local voice-call webhook.
• ngrok exposes that local webhook to Twilio over a public HTTPS URL.
• OpenAI realtime voice makes the call behave like a live conversation.

What You Need

• A working OpenClaw install
• A Twilio account
• A Twilio voice-capable phone number
• Your Twilio Account SID and Auth Token
• An ngrok account and auth token
• OpenAI/OpenClaw auth capable of using OpenAI realtime voice

If you are using a Twilio trial account, Twilio may play a trial-account prompt before connecting the call. During testing, press the key Twilio asks for so the call continues into OpenClaw.

Step 1. Get A Twilio Phone Number

Create or log into your Twilio account: https://console.twilio.com/dashboard

From the Twilio dashboard, find or purchase a voice-capable phone number.

You will need:

• Twilio phone number
• Twilio Account SID
• Twilio Auth Token

Step 2. Enable The Voice Call Plugin In OpenClaw

Run the OpenClaw onboarding/configuration wizard. Launch the terminal app and run the following command:

openclaw onboard

Enable the Voice Call plugin under the plugin/skills section of the onboarding wizard.

Select Twilio as your provider

When prompted for the Twilio phone number, enter your Twilio number in E.164 format (e.g., +13101112222) in the From Number field

When prompted for inbound policy, start with:

allowlist

Then add only your own phone number to the allowlist. This prevents random callers from reaching your agent while you are testing.

When prompted for the Twilio Account SID, paste the Account SID from the Twilio dashboard.

After you provide the SID and hit enter, you will receive a sensitive field notice, like below. You will need to run this after we complete the onboarding wizard.

Select conversation as the default call mode.

If the wizard asks for webhook host/port before ngrok is configured, use local values for now:

Webhook host: 127.0.0.1
Webhook port: 3334

For session scope, select per-phone. This is so the conversation continues across calls. You would use per-call if you were configuring this as a call center, where each conversation starts fresh with each call.

Select per-phone

That should have been the last question. Finish the wizard. If it asks how you want to launch/hatch the bot and you are not ready yet, choose the “do this later” option.

Step 3. Add The Twilio Auth Token

After the wizard completes, add your Twilio Auth Token:

openclaw config set plugins.entries.voice-call.config.twilio.authToken <TWILIO_AUTH_TOKEN>

Replace <TWILIO_AUTH_TOKEN> with the token from your Twilio dashboard.

Do not publish this token in screenshots, blog comments, GitHub issues, or logs.

Restart the OpenClaw Gateway:

openclaw gateway restart

Then check the Voice Call plugin setup by running this command:

openclaw voicecall setup

You want the setup checks to pass before moving on. You will most likely notice that it falls the webhook check. You should see something similar to the below screenshot. Which is expected. We will configure the webhook in step 4.

Step 4. Configure ngrok For The Public Webhook

Twilio cannot reach a webhook on 127.0.0.1 from the public internet. Your local OpenClaw instance needs a public HTTPS URL that forwards to the local voice-call webhook. That is what ngrok provides.

Create an ngrok account and find your auth token here: https://dashboard.ngrok.com/get-started/your-authtoken

If you have a reserved ngrok domain, use it. A stable domain is much easier than updating Twilio every time ngrok starts.

You can ask your OpenClaw agent to configure ngrok with this prompt:

Help me configure the OpenClaw voice-call plugin webhook using ngrok.

Please do the following:

1. Inspect my OpenClaw config and determine the voice-call webhook server port/path.
2. Check whether ngrok is already installed and available to the Gateway process.
3. If ngrok is not installed, install the standalone ngrok binary as the standard OpenClaw user, not via admin Homebrew, unless my environment clearly uses a different safe pattern.
4. Make sure the Gateway launch/service environment can find the ngrok binary after restart.
5. Ask me for my ngrok auth token if you need it. Do not print it back or store it in memory/log notes.
6. Configure plugins.entries.voice-call.config.tunnel.provider = "ngrok".
7. If I have a reserved ngrok domain, configure it as plugins.entries.voice-call.config.tunnel.ngrokDomain.
8. Restart the OpenClaw Gateway.
9. Verify the setup with openclaw voicecall setup.
10. Show me the final public webhook URL I should use for Twilio, usually:
https://<my-ngrok-domain>/voice/webhook

Be careful not to delete files or run destructive commands. If you modify config files, summarize exactly what changed and confirm that the final setup check passes.

After this step, your public webhook should look like:

https://your-ngrok-domain.ngrok-free.dev/voice/webhook

Step 5. Update The Twilio Webhook

In the Twilio console, open your Twilio phone number settings. Look for the Voice webhook section.

If it still points at Twilio’s demo app, replace it with your OpenClaw ngrok webhook:

https://your-ngrok-domain.ngrok-free.dev/voice/webhook

Use HTTP POST.

This is especially important for inbound calls. For outbound calls, OpenClaw can provide a per-call webhook URL through the Twilio API, but it is still worth making the Twilio number configuration match your OpenClaw webhook.

Step 6. Enable OpenAI Realtime Voice

This was the key fix in my setup.

The default Voice Call conversation path may use short Twilio TwiML/Gather redirects. In my testing, outbound calls would ring and answer, but then immediately complete. Twilio showed the call as successful, but the duration was 0 seconds.

The useful Twilio error was:

21220: Call is not in-progress. Cannot redirect.

That meant OpenClaw was trying to redirect/update the live call after Twilio had already marked it completed.

The fix was to enable realtime voice mode for the Voice Call plugin. This changes the call from a short TwiML redirect flow into a live Twilio Media Stream connected to OpenAI realtime voice.

Example config shape:

plugins.entries.voice-call.config.realtime.enabled = true
plugins.entries.voice-call.config.realtime.provider = "openai"
plugins.entries.voice-call.config.realtime.providers.openai.model = "gpt-realtime-2"
plugins.entries.voice-call.config.realtime.providers.openai.voice = "cedar"
plugins.entries.voice-call.config.realtime.consultPolicy = "always"

Your agent should have configured this portion for you with the above prompt, but you can check by restarting the gateway (openclaw gateway restart) and then verify by running this command:

openclaw voicecall setup

You want to see:

OK mode: Realtime voice enabled (openai)

If you don’t see openai configured, simply ask your agent to configure the voice call plugin with the OpenAI realtime voice.

Step 7. Tune Realtime Voice Behavior

Once realtime voice is working, you may notice that the assistant gets interrupted too easily. That is usually barge-in behavior: the realtime model hears input audio and cancels its current response so the caller can speak.

That is useful, but it can be too sensitive on phone audio.

This conservative tuning worked better for my setup:

interruptResponseOnInputAudio: false
vadThreshold: 0.65
silenceDurationMs: 650
prefixPaddingMs: 300
minBargeInAudioEndMs: 800

What these do:

• interruptResponseOnInputAudio: false makes the assistant less likely to stop talking immediately when it hears noise.
• vadThreshold: 0.65 makes speech detection less sensitive.
• silenceDurationMs: 650 waits a little longer before deciding your turn is finished.
• prefixPaddingMs: 300 preserves a little audio before detected speech starts.
• minBargeInAudioEndMs: 800 prevents extremely early interruptions.

The tradeoff is that the conversation may feel slightly less instant, but it is usually more stable.

Step 8. Test An Outbound Call

Place a test call:

openclaw voicecall call --to "+1YOURNUMBER" --mode conversation --message "Hello, this is a test call from my OpenClaw agent."

If you are on a Twilio trial account, listen for the Twilio prompt and press the requested key to continue.

During a successful realtime call, OpenClaw should show transcripts and realtime events.

Check active call status:

openclaw voicecall status --json

Or inspect a specific call:

openclaw voicecall status --call-id <CALL_ID>

Or even better, simply ask your OpenClaw agent to call you via sending him a message via Telegram.

Congratulations! You have now configured your agent with a phone number and voice calling capabilities. You can have it call you on a schedule to provide you summaries of what it’s working on. You can call it and talk through your to do tasks on your drive home. You can even have it call a restaurant and make reservations for you. Yes, I tried it and although there can be some issues, it did work! Imagine all the restaurant staff taking calls from digital assistants trying to book a reservation. Yes, we are already there.

Troubleshooting Scenarios

The below are some examples of road bumps I hit along the way. In case you come across the same. I highly recommend you to leverage your agent as you work through these. In most cases, your agent will be able to update it’s own config to address these issues.

1. The call rings, then immediately hangs up

Check Twilio call logs. If the call shows Completed with 0 sec duration, inspect the event details.

If you see this, enable realtime voice mode:

21220: Call is not in-progress. Cannot redirect.

The default redirect flow is likely completing before OpenClaw can move the call into listening mode.

2. Twilio plays an opening message

That is usually the Twilio trial-account prompt. Press the key Twilio asks for to continue the call. For a clean production experience, upgrade the Twilio account so trial prompts are removed.

3. The Twilio webhook points to the demo app

Replace the demo webhook with your ngrok webhook and use HTTP POST:

https://your-ngrok-domain.ngrok-free.dev/voice/webhook

4. OpenClaw and the plugin versions are out of sync

If the Voice Call plugin or Gateway behaves strangely after install, update OpenClaw from the correct account/environment for your machine:

openclaw update
openclaw gateway restart
openclaw doctor
openclaw doctor --fix
openclaw voicecall setup

5. The wrong phone number is configured

Use E.164 format. For US numbers, include +1. If you accidentally entered a number without the country code, update the config (edit the phone number in your openclaw.json file) and rerun the following command to confirm:

openclaw voicecall setup

6. ngrok works manually, but the Gateway cannot find it

If ngrok was installed into a user-local path, make sure the Gateway service environment includes that path. This matters when the Gateway runs through launchd or another service manager instead of your interactive shell.

After changing the service environment, restart the Gateway and rerun:

openclaw voicecall setup

Final Working Setup

• Twilio regular voice-capable phone number
• Twilio Voice webhook pointed to the ngrok public URL
• OpenClaw Voice Call plugin using ngrok tunnel
• OpenAI realtime voice enabled in the Voice Call plugin
• Gateway restarted after config changes
• openclaw voicecall setup passing

Once those pieces were in place, outbound calls connected, the realtime bridge started, and OpenClaw transcribed live caller audio.

Security Notes

Keep these stored in a password manager and never share:

• Twilio Auth Token
• ngrok Auth Token
• Telegram bot token
• OpenClaw Gateway auth token
• Full config files unless secrets are redacted

Use allowlists while testing inbound calls. Open voice access is powerful; treat it like giving someone a live phone line to your agent.

The post Step-by-Step Guide: Give Your OpenClaw Agent a Phone Number and Voice Calling Capabilities appeared first on Joshua Bellendir.

OpenClaw is an open-source AI agent framework that allows you to run a persistent, self-hosted AI assistant locally on your own hardware. Unlike traditional chatbots that only respond within a browser window, OpenClaw can interact with your operating system, manage files, execute commands, automate workflows, and integrate with external services like Telegram, WhatsApp, GitHub, and Google Workspace.

What makes OpenClaw particularly interesting is that it combines modern large language models with long-running agent behavior and local infrastructure control. In practical terms, this means you can build an AI assistant that operates more like a lightweight autonomous operator than a simple chatbot.

For many people, the appeal of OpenClaw is control:

• Your agent runs on hardware you own
• You decide what services it can access
• You control the security boundaries
• You can extend it with skills, plugins, and automation workflows

But that same level of capability also introduces risk.

An AI agent with filesystem access, shell access, internet connectivity, and persistent runtime behavior should be treated carefully. Unfortunately, many setup guides focus heavily on functionality while spending very little time discussing operational security or least-privilege deployment practices.

This guide focuses specifically on deploying OpenClaw securely on a Mac Mini using:

• a dedicated non-admin user account
• Local-only gateway binding (127.0.0.1)
• hardened macOS security settings
• Telegram allowlists
• persistent background services
• post-installation security auditing

The goal is not enterprise-grade hardening, but rather a practical and security-conscious deployment suitable for hobbyists, developers, technologists, and home lab users who want to experiment with AI agents responsibly.

Figure 1: High-level security architecture for a hardened OpenClaw deployment on macOS using least privilege principles and local-only gateway exposure.

Recommended Hardware

For a smooth experience, I recommend (at minimum):

• Mac Mini M4
• 16GB RAM minimum
• 256GB SSD minimum

Apple Silicon performs exceptionally well for local AI agent workloads while maintaining very low power consumption.

You should also plan for:

• 1–3 hours of setup time
• An LLM provider account (OpenAI, Anthropic, Gemini, etc.)
• A Telegram account (for this guide)

Why Run OpenClaw Under a Dedicated User Account?

OpenClaw is capable of:

• Reading files
• Executing shell commands
• Connecting to external services
• Automating workflows
• Running continuously in the background

For that reason, I strongly recommend running it under a dedicated standard (non-admin) macOS account rather than your primary administrator account.

This limits the blast radius if:

• The agent misbehaves
• A plugin is compromised
• Credentials leak
• Remote access is abused
• An automation accidentally performs destructive actions

Treat AI agents the same way you would treat any long-running automation service or daemon: least privilege should be the default.

Step 1: Update macOS

Before beginning, make sure your Mac Mini is fully updated.

Go to:

System Settings → General → Software Update

Install all available updates before continuing.

Step 2: Create a Dedicated Standard User

Create a dedicated standard (non-admin) user account that will run the OpenClaw agent.

Go to:

System Settings → Users & Groups → Add User

Create:

• Account Type: Standard
• Suggested Username: openclaw

This user account will:

• Run the OpenClaw gateway
• Own the workspace files
• Limit administrative access

 Important
All software installation steps below should initially be performed from your administrator account. We will switch to the dedicated standard user later when onboarding the OpenClaw agent itself.

Step 3: Configure macOS Power Settings

Since OpenClaw is designed to run continuously, we want the Mac Mini to remain awake and recover automatically after power outages.

Go to:

System Settings → Energy

Enable:

• Prevent automatic sleeping when the display is off
• Start up automatically after a power failure

This ensures:

• The system stays online
• The agent remains accessible
• Services recover automatically after outages

Step 4: Enable FileVault Disk Encryption

Go to:

System Settings → Privacy & Security → FileVault

Enable:

• FileVault

This encrypts the disk and protects local data if the machine is lost or stolen.

Step 5: Configure the macOS Firewall

Go to:

System Settings → Network → Firewall

Enable:

• Firewall

Then click:

Options...

Enable:

• Stealth Mode

Depending on your environment, you may also choose to:

• Block all incoming connections

 Note
Blocking all incoming connections can interfere with some remote management or VNC workflows. If you enable it temporarily during setup, remember to re-test connectivity afterward.

Step 6: Install Required Software

We now need to install the following:

• Homebrew
• Node.js
• npm (Node Package Manager) – this will install as part of the Node.js installation

All of these steps should still be performed from your administrator account.

Install Homebrew

Open the Terminal app and run:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

The installation may take several minutes. 

At the end of the installation, Homebrew will provide commands to add itself to your shell path.

It should look something like this:

echo >> /Users/YOURUSERNAME/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/YOURUSERNAME/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"

Run the commands provided by the installer for your environment.

Verify the installation:

brew --version

If successful, Homebrew will return its installed version number.

Install Node.js

Install Node.js using Homebrew:

brew install node

Verify the installation:

node --version

OpenClaw currently requires Node.js v22 or later.

Install OpenClaw

Still under your administrator account, install OpenClaw globally:

npm install -g openclaw@latest

Verify the installation:

openclaw --version

At the time of writing, version 2026.01.29 was installed.

 Important
We are only installing OpenClaw from the administrator account.
The actual onboarding and runtime configuration will happen under the dedicated standard user account.

Optional: Using Screen Sharing to Remote Into the Standard User Account (OpenClaw)

Instead of constantly logging in and out between the admin account and the openclaw account, we can remotely access the local standard user session via Mac’s built in Screen Sharing app. MacOS does not directly support local VNC loopback access out of the box, but we can create a workaround using SSH tunneling.

This section is completely optional. If you prefer to just switch back and forth between your admin and standard user account, jump down to Step 7 to onboard your OpenClaw agent.

Enable Screen Sharing and Remote Login

Go to:

System Settings → General

Enable:

• Screen Sharing
• Remote Login

For both settings (Screen Sharing and Remote Login):

• Add your standard user account (openclaw) to the allowed users list.

Example of Screen Sharing Settings:

You can access these settings using the small (i) information button beside each option.

 Important
If the openclaw user is not explicitly added to both allowlists, authentication will fail later.

Create the SSH Tunnel

From your administrator account, open Terminal and run:

ssh -NL 5901:localhost:5900 openclaw@localhost

Replace:

• openclaw with your standard username

If prompted:

• Accept the SSH connection
• Enter the password for the standard user account

If successful, the terminal will appear to “hang”. This is expected behavior. Leave the terminal window open, as this is what is establishing the SSH tunnel. You need this active to connect via screen sharing.

 Important
If you don’t know your user’s short username, log into your user account and type “whoami” into a terminal window. It will respond with your user’s short username.

Connect Using Screen Sharing

Launch the macOS Screen Sharing app.

Connect to:

vnc://localhost:5901

When prompted for credentials, enter:

• Username: openclaw
• Password: your standard user password

Important: After entering your credentials, on the next pop up window, select “log in as yourself” and click connect.

You should now have a remote desktop session into the standard user account.

This makes it easier to:

• Copy/paste commands
• Manage onboarding
• Switch between accounts
• Monitor the agent

Once setup is complete, you can disable:

• Screen Sharing
• Remote Login

Step 7: Onboard the OpenClaw Agent

Important: The onboarding and configuration steps below should be performed from your standard non-admin user account (openclaw). You can either log into the “openclaw” standard user account or use the remote screen sharing method described in Step 6 above.

Before onboarding, verify OpenClaw is accessible via your standard user account (openclaw):

openclaw --version

You should receive the installed version number.

Now begin onboarding:

openclaw onboard

This launches the onboarding wizard.

Recommended Onboarding Configuration

Below are the settings I recommend as of May 2026.

OpenClaw Security Disclaimer

Select:

Yes

Setup Mode

Select:

Manual

This allows us to explicitly configure each setting.

What Do You Want to Set Up?

Select:

Local gateway (this machine)

Workspace Directory

Select:

/Users/openclaw/.openclaw/workspace

Hit enter to use the default suggested directory unless you have specific requirements.

Model / Authentication Provider

Choose your preferred LLM provider. 

Examples:

• OpenAI
• Anthropic
• Gemini
• Grok
• Codex

This guide is going to walk you through configuring OpenAI using the OAuth method, but feel free to use your preferred provider and follow the onscreen directions. Otherwise, let’s proceed with OpenAI.

When I initially tested OpenClaw, I used the OpenAI API with the gpt-4o model (gpt-4o-mini is also a good choice if going with the API). It worked very well, but token usage can increase quickly depending on context size and agent activity. The OAuth method is a much cheaper alternative to the API. 

So for my second deployment of OpenClaw, I switched to OpenAI Codex OAuth.

Since I already had a paid OpenAI subscription, this avoided API token management and additional usage costs. If you don’t have an OpenAI Pro subscription already, create an OpenAI account and upgrade to Pro for $20/month. Well worth it and is required for this setup. 

If using your OpenAI Pro Account (OAUTH):

• Select OpenAI Codex
• Authenticate via OAuth
• Keep the default model (gpt-5.5)

Gateway Configuration

Recommended settings:

Port: 18789
Bind: 127.0.0.1
Auth: Token mode
Tailscale exposure: Off

As shown in Figure 1 above, the OpenClaw gateway is intentionally bound to localhost (127.0.0.1) and isolated under a dedicated non-admin user account.

For the token:

• Select Generate/store plaintext token
• Leave the token field blank to auto-generate

 Important
Binding to 127.0.0.1 is one of the most important security settings in this guide.
This prevents the gateway from listening publicly on your network interfaces.

Configure Chat Channels

Select:

Yes

For this guide, we will use Telegram.

Telegram is one of the easiest integrations to configure and works well for interacting with the agent remotely. Another popular channel to use would be WhatsApp, but the telegram setup is a bit easier, so we will go with that for now. You can always change this later by re-running the onboarding wizard.

Create a Telegram Bot

Before we proceed with the channel setup using Telegram, we need to setup a Telegram Bot which will be used as the Telegram user for our OpenClaw agent. If you don’t already use Telegram, simply download the Telegram app and register a new account.

Telegram has an official bot called the BotFather which is used to register Bots on the platform.

Open the Telegram app and search for:

@BotFather

Start a chat and run:

/newbot

BotFather will ask for:

• A display name
• A username ending in bot

Once completed, BotFather will provide:

• A bot token

Save this token.

Return to the OpenClaw onboarding wizard and select Telegram (Bot API) under the list of chat channels.

• Select “Enter Telegram bot token”
• Paste the token

Once you have successfully added the Telegram channel, select “Finished” on the select a channel option.

Configure Telegram Access Restrictions

After adding Telegram, OpenClaw will display a warning about DM pairing access.

By default:

• Any Telegram user can attempt to pair with your bot

For improved security, I strongly recommend:

• Using an allowlist and restrict to only your Telegram user.

Select:

Allowlist (specific users only)

You will now need your Telegram numeric user ID.

Find Your Telegram User ID

Open the Telegram app and search for:

@rawdatabot

Start a chat and run:

/start

This bot will return your:

• User ID / Chat ID

Copy your numeric Telegram user ID and paste it into the OpenClaw onboarding wizard.

This restricts communication to only your Telegram account. 

One of the more interesting aspects of OpenClaw is that once the agent is operational, it can manage many of these configurations for you directly. For example, if you want to grant a trusted contact access through your Telegram bot, the agent can add their Telegram user ID to the allowlist automatically.

 Important
Be cautious when granting access, as anyone added to the allowlist may be able to control the agent and execute actions on your Mac Mini depending on the permissions and integrations configured

Search Provider

I recommend either:

• Brave Search
• DuckDuckGo

Both work well for general agent usage. I suggest to go with DuckDuckGo as it’s free. You can always rerun the onboard wizard and change to a different provider. 

Skills, Plugins, and Hooks

For your initial deployment, I recommend skipping:

• Skills
• Plugins
• Hooks

Get the base platform stable first before expanding functionality. We will come back to this in a future guide. You can always rerun the onboard wizard to enable these, or even better, ask your agent once it’s hatched to enable them for you. 

The best skills to enable for foundational automation and productivity would be:

Install Gateway Service

Select:

Yes

This is the second most important setting.

Without this:

• the gateway stops when the terminal closes

With the gateway service installed:

• OpenClaw runs persistently in the background
• It survives reboots
• It behaves like a proper daemon/service

Gateway Runtime

Select:

Node (recommended)

Once the gateway is running, the OpenClaw onboarding wizard will output a bunch of helpful information. I strongly suggest to copy the text and paste into notepad to reference later. 

For example, it will provide you with the Control UI information, which includes your token to access the OpenClaw web dashboard, where you can interact with your agent, update the OpenClaw software, add skills, and much more. If you’re not comfortable in the command line, you’ll want to use the OpenClaw dashboard. 

◇  Control UI ─────────────────────────────────────────────────────────────────────╮
│                                                                                  
│  Web UI: http://127.0.0.1:18789/                                                 
│  Web UI (with token):                                                            
│  http://127.0.0.1:18789/#token=THIS_WILL_BE_YOUR_SPECIFIC_TOKEN │
│  Gateway WS: ws://127.0.0.1:18789                                                
│  Gateway: reachable                                                              
│  Docs: https://docs.openclaw.ai/web/control-ui     

Bring the Agent Online

At the end of onboarding, OpenClaw will ask:

How do you want to hatch your bot?

Select:

Open the Web UI

Your agent will now come online.

You will likely see something similar to:

Hey. I just came online. Who am I? And who are you?

We’ve got a fresh workspace, so I’m supposed to figure myself out with you a bit: name, what kind of creature I am, my vibe, and a         
signature emoji.

If you’re feeling playful, toss me a name. If not, I can suggest a few.

Bootstrap Your Agent

I recommend starting with a clear operational prompt.

Paste the below (tweak as needed) into the chat window with your agent.

You are (Insert Name). I am (Insert Name).

Be direct, concise, and honest. If I ask you to do something dumb or risky, push back and tell me why. Don’t sugarcoat or over-explain. I’d rather hear a problem than have you blindly execute.

You’re running on a Mac Mini as my personal assistant. 

Core rules: Never delete files, send messages, or run commands with side effects without confirming with me first. Ask before acting on anything destructive or irreversible. Keep responses short unless I ask for detail. Flag security concerns proactively.

This helps establish:

• tone
• behavioral boundaries
• operational expectations
• safety controls

Post-Onboarding Security Hardening

Before you begin expanding the agent’s capabilities, let’s run a few security checks against the installation.

Run the following security audits:

openclaw security audit --deep
openclaw security audit --fix

The audit will catch common misconfigurations – e.g., open DM policies, incomplete allowfrom configurations, exposed gateway, and weak permissions. The –fix flag fixes what it can.

OpenClaw Doctor is your Friend

The openclaw doctor is a built-in diagnostic and repair tool for the OpenClaw AI ecosystem that scans for and fixes issues with configurations, file permissions, and port conflicts. It acts as an automated health check, ensuring that the gateway, channels, and local models are communicating properly. 

Key functions of the command include:

• Health Checks: Inspects ~/.openclaw/openclaw.json and directory structures for errors.
• Automated Repairs: When run as openclaw doctor –repair, it fixes issues like stale configurations, port conflicts (default port 18789), and corrupted workspace indexes.
• Migrations: Handles legacy state migrations to ensure the installation uses the latest file structures.
• Security Audit: Identifies potential security issues, such as dangerous debug flags or improper authentication. 

Common Commands:

 Important.
It is highly recommended to run this command after updating OpenClaw, changing configurations, or installing new skills to ensure the system is stable. 

Useful OpenClaw Commands

Commands for Standard User Account (openclaw):

Commands for Admin User Account:

 Important
Most runtime and gateway commands should be executed from the dedicated standard user account, not the administrator account.

After updating OpenClaw from the admin account, make sure you restart the gateway service under the standard user account with the following command: openclaw gateway restart.

Final Thoughts

OpenClaw is one of the most popular open-source AI agent frameworks currently available for users who want:

• local control
• extensibility
• persistent automation
• self-hosted infrastructure

The most important recommendation I can give is this:

Treat AI agents like infrastructure.

Run them with least privilege, isolate them from your primary environment, and avoid exposing services publicly unless absolutely necessary.

Regularly run security audits and the OpenClaw doctor to ensure your installation remains stable and secure over time.

A Security Checklist to Live By:

• Protect your API keys (keep them in your preferred password manager)
• Run OpenClaw under a dedicated non-admin MacOS user
• Keep OpenClaw updated with the latest version (regularly check for updates)
• Do NOT expose port 18789 publicly
• Gateway bound to 127.0.0.1
• FileVault enabled
• MacOS firewall enabled w/ blocking incoming connections
• Token auth on gateway
• DM set to pairing with channel allowlist limited to your Telegram user only
• If using cloud LLM API (e.g., OpenAI, Claude Opus 4.6, Grok), ensure API spending limits set with provider
• Review permissions carefully and instruct your agent to always review requests to ensure they are not risky
• Run openclaw security audit –deep regularly
• Never install untrusted skills / All ClawHub skills reviewed before installation

The post How to Securely Run OpenClaw on a Mac Mini (Step-by-Step Guide) appeared first on Joshua Bellendir.

Click here to see the device in action and read MishiPay’s LinkedIn post for a behind-the-scenes look at the pilot.

#RetailTech #POS #DigitalTransformation #Teamwork #F1 #AirportRetail #NewLaunch

The post From Concept to Checkout in 7 Weeks: A Next-Gen POS Pilot in Airport Retail appeared first on Joshua Bellendir.

These hacking groups are openly recruiting employees and paying for insider access. Their target list spans telecom, retail, tech, cloud, gaming, and BPO companies. The sophistication of their social engineering and the speed at which they exploit access continues to increase.

For many companies, the biggest risk is not just external attackers. It is the combination of human behavior, access sprawl, weak identity governance, and the absence of strong cultural reinforcement around security.

This raises an important question for all of us in the industry:

What steps are you taking inside your organization to reduce the risk of insider threats?

Are you doubling down on identity governance, monitoring privileged access, improving off-boarding processes, building stronger security awareness programs, or investing in tools that help detect unusual behavior across your environment?

Curious to hear how others are approaching this challenge and what is working well in your companies.

You can read the full article here: https://www.bleepingcomputer.com/news/security/crowdstrike-catches-insider-feeding-information-to-hackers/

The post The Growing Insider Threat: Why Trusted Access Is Now One of Cybersecurity’s Biggest Risks appeared first on Joshua Bellendir.

What’s your take: should unmanaged devices ever touch corporate systems?

Read the full story on CSO Online:

The post One Unprotected Laptop Is All It Takes appeared first on Joshua Bellendir.

Read more about them here

The post Celebrating Innovation and Leadership at the 2025 Las Vegas Top Tech Awards appeared first on Joshua Bellendir.

The post From Vision to Reality: Uniqlo’s Record Growth and Global Momentum appeared first on Joshua Bellendir.

The post Why Every IT Leader Should Read “Fostering Innovation” by Andrew Laudato appeared first on Joshua Bellendir.

I was pleased to be quoted in the piece and wanted to share a few reflections on what these themes mean for my own work and for IT leadership more broadly.

1. From IT Projects to Business Transformation

The article highlights an important shift. We are not simply delivering IT projects. We are leading business transformation efforts that rely on technology to succeed. In my work at WHSmith, SoftBank Robotics, and Fast Retailing (Uniqlo), this distinction has been clear. Success is not measured by implementing a system. It is measured by how the business changes, how operations improve, and how growth accelerates.

2. Value Creation and Revenue Focus

CIOs are increasingly being evaluated on their ability to create value. The article notes that many organizations are now directing investment toward monetizing data and developing new digital revenue streams. For me, this shift reinforces the need to align all technology programs with measurable business outcomes, whether they involve new customer engagement channels, loyalty initiatives, or improved retail experiences.

3. Scaling AI for Real Impact

Impactful AI continues to rise on priority lists. The article suggests that the age of pilots is fading and CIOs are now concentrating on enterprise level adoption, governed data pipelines, and models tailored to specific use cases. In my experience, the foundation matters most. Data, pipelines, governance, and model discipline must come before the question of what can be automated or predicted next. Trust and value both depend on that groundwork.

4. AI Security and Governance

The potential of AI comes with new risks. Many CIOs are treating AI as a new security frontier that covers model transparency, vendor oversight, and adversarial threats. From my perspective, governance and security need to be part of the design from the beginning. They cannot be bolted on after momentum builds.

5. Enterprise Security

Security remains a constant priority. Even as innovation accelerates, strengthening the overall security posture continues to sit at the top of CIO agendas. This reinforces something I have believed throughout my career. No matter how forward leaning the roadmap is, the foundation must be strong. You cannot build advanced capabilities without protecting the core first.

6. Customer Experience (CX)

Improving customer experience remains a defining project area, and it frequently sits at the intersection of digital, operations, and culture. The article cites examples such as automated quoting, AI enabled support, and self service capabilities. In retail and F&B environments, I have seen that the technology used by store teams and customers is only as strong as the systems behind it. Real time data, analytics, integration, and reliable infrastructure matter just as much as the features that appear on a screen.

7. The IT Foundation

While emerging technologies receive much of the attention, the foundational elements remain essential. ERP modernization, cloud optimization, integration layers, and API strategies are still at the center of effective transformation. In my roles, ensuring that the foundation is stable and current has always been a priority. Innovation only scales when the core environment can support it.

8. IT Modernization

For many organizations, modernization is both the engine of change and the enabler. It often involves retiring legacy systems, introducing modern platforms, moving toward cloud first strategies, and enabling better scalability. The article includes a quote that captures this direction well:

“Retiring old legacy systems that are slowing us down, introducing modern solutions… everything we do will support our data initiatives and will give us the data we want for AI and allow us to scale and the business to grow.”

This reflects much of what I have focused on in large scale retail and global operations environments.

9. Reimagining IT for the Future

One of the most important shifts is a forward looking mindset. The focus is no longer on what the company needs today but on what it will need two, three, or five years from now. The article references my work in future proofing IT environments and improving scalability by implementing solutions that are efficient, flexible, and designed to support long term growth. This is central to the CIO role. We are not only supporting current operations. We are shaping the technology landscape that the business will rely on in the future.

My Reflections for IT Leaders

• Be strategic first. Projects should be framed around business impact, not technical activity.
• Align every initiative with a measurable outcome such as revenue growth, margin improvement, or customer experience.
• Build the foundation early. Innovation only succeeds when data, security, governance, and core systems are strong.
• Look ahead. Modular architectures, scalable operating models, and global flexibility are no longer optional for competitive organizations.
• Lead with confidence. CIOs are not simply maintaining the business. They are helping to reinvent it.

The post Quoted in a Recent CIO.com Article: 9 Projects Top of Mind for IT Leaders Today appeared first on Joshua Bellendir.