Best Practices

Production guidance for secure KorClaw integrations.

Keep API keys server-side and load them from a secrets manager.
Use one key per environment and rotate keys without downtime.
Send complete agent, action, resource, and severity fields for audit events.
Treat policy evaluation as a deny-capable decision point and fail closed for high-risk workflows.
Persist request IDs and event IDs in your application logs for support and investigations.
Use bounded retries and idempotency in your own job workers.