Simon Willison's lethal trifecta is the combination of private data access, untrusted content, and external communication. The recommended mitigation is to cut off at least one leg. That's exactly what Shield's per-service read/write/execute controls do. Revoke write access on email, and the agent can't exfiltrate through it. Revoke execute on terminal, and it can't run arbitrary commands. You choose which legs to cut per agent, per service.

Shield doesn't solve prompt injection. Nothing does yet. But it constrains the blast radius, which is the same approach Willison, Google's agent security paper, and Meta's Rule of Two all recommend: architectural boundaries enforced outside the model, not prompt-level guardrails.

On the architecture: Shield hooks into OpenClaw's native Plugin API (before_tool_call / after_tool_call), so it intercepts at the tool execution layer before the call reaches the system. It's not a wrapper or an afterthought.

And to be clear, Shield is a personal project. It has nothing to do with Atlassian or Rovo. I mentioned my role because building agent infrastructure professionally is how I recognized the gap in the open-source ecosystem. Atlassian already has its own agent governance infrastructure. Most teams building on OpenClaw don't.

If you want to see how Shield works under the hood: https://multicorn.ai/shield