Hardened execution guardrails — because production only gets one chance.v1.2.1

An engineer asks Claude to run a cleanup script that drops stale tables in a production PostgreSQL instance. ProdShield detects the 'prod' indicator, blocks the DROP TABLE, warns the user it is irreversible, and requests explicit confirmation. This prevents loss of transactional financial records and keeps the service compliant.

A DevOps team uses Claude to trigger Terraform apply on a live AWS environment. ProdShield recognizes the 'live' environment, enforces a dry-run first, confirms rollback and health-check plans, and requires second-approver sign-off before applying. This avoids accidental destruction of production clusters and improves release safety.

A developer asks Claude to commit and push code containing an embedded API key. ProdShield scans git commit/push actions involving sensitive credentials, blocks the push, and prompts the user to rotate and remove the secret first. This prevents a public breach and protects customer data.

Claude is asked to install an unverified npm package from an unknown source via curl|bash. ProdShield checks the source, detects a lockfile absence, and refuses execution until the package and script are inspected. The team avoids malware and keeps builds reproducible.

A health-tech analyst asks Claude to run a data migration that includes real PII. ProdShield classifies the database as production due to PII and requires backup confirmation, a dry run, and explicit written approval. This protects patient data and ensures regulatory compliance.

The core guardrail skill is free to install for individual developers and small teams, with basic environment detection and prohibition rules. Paid tiers unlock advanced features like team policies, audit logs, and custom approval workflows. This drives adoption through the OpenClaw marketplace and upsells larger organizations.

ProdShield is licensed as a mandatory security layer for enterprise OpenClaw deployments. It integrates with existing IAM, approval systems, and SIEM tools, and provides compliance reporting for SOC 2, HIPAA, and PCI. Enterprises pay an annual license based on number of agents or environments protected.

A hosted service where companies define custom guardrail policies (e.g., which environments require 4-eyes, which secrets are sensitive) and ProdShield enforces them across all agents. The vendor manages updates, threat intelligence, and incident playbooks. Customers pay a monthly fee based on usage volume.