A report from inside. Several weeks of running an AI agent in the daily operations of a German construction planning and project management firm, including the parts that did not work.
Reading is free, acting asks. The machine gathers, the human decides and signs. The hard part was never the model, it was deciding what the thing is allowed to touch.
Alpha Quadrat is a construction planning and project management firm in Wuppertal, Germany. We are small. We work for public clients and private owners, which means we sit inside German procurement rules, German professional liability and the GDPR, and none of those were written with autonomous agents in mind.
We have been running OpenClaw in daily operations for several weeks. This is a report from inside a regulated business, written because there is no published account of what that is actually like. It includes the parts that did not work.
One OpenClaw instance on a Mac mini, an agent we call safi, wired into the office: mail, calendar, documents, a Slack workspace, a handful of internal scripts. Its boot instructions are four lines long and mostly negative: answer short and direct, on an error confirm the cause before proposing exactly one fix, never repeat yourself in a loop, compress large logs. Every line of that was added after watching it do the opposite.
The work it does well is the work nobody wants: watching an inbox, noticing that a reply came in, pulling a reference number out of a document, checking whether a deadline moved. Not the interesting decisions. The attention.
Narrow jobs with a clear success condition. A mail watcher that checks one mailbox every five minutes for replies from specific senders, filters autoresponders, and posts a line to a Slack channel. It has been running without intervention since late August.
Making the agent report to a place we can read back. We started with WhatsApp because it reaches a phone. We moved the reporting to Slack for a boring reason that took us a while to see: a Telegram bot cannot read its own history, and our WhatsApp path is write only. Slack is the only channel where the agent can both write a message and later read what it wrote. Agents that cannot re-read their own output cannot check their own work.
Writing down what is actually true instead of what we assumed. Our own rule, learned the hard way: claim nothing that has not been measured. A self test that reports 28 of 28 green is a fact. A self test that reports 26 is a finding, not a rounding error.
OpenClaw's own cron for routine checks. Its scheduler is agent based, so every run costs a model call. For a job that runs every five minutes and is a plain conditional in ninety-nine runs out of a hundred, that is the wrong shape. We moved those jobs to launchd with small Python scripts and kept OpenClaw for the calls that actually need judgment. This is not a criticism of the design, it is a boundary we had to find by paying for it first.
There is no mail channel. OpenClaw has chat transports: WhatsApp, Telegram, Discord, IRC, Google Chat, Slack, Signal, iMessage. There is no SMTP. For a business whose entire external correspondence is email, that is a real gap, and we bridge it outside OpenClaw.
Memory fragmented on us. We now have four separate stores that all believe they know the current state: OpenClaw's own memory, a second memory system belonging to another tool, dated plain text day logs, and an Obsidian vault. Together roughly four hundred megabytes. Each is individually defensible. Together they produce the failure mode where you ask where things stand and get a confident answer from the store that happens to be months out of date. Our fix is crude and works: one snapshot script writes the current state to a single file, and that file is the only thing anyone reads first.
The sandbox and the real machine disagree about the network. Plenty of our install steps only work when run directly on the machine rather than inside the agent's environment. We stopped fighting this and made it explicit in the runbook.
This is the part that matters for anyone in a regulated business, and it is the reason we are careful in public about what we claim.
OpenClaw's security record is documented and mixed. Cisco found a third party skill exfiltrating data via prompt injection. China barred it from government office machines in March 2026. The Register's criticism of the 2.0 release was that it is not safe out of the box. None of that is a reason not to use it. All of it is a reason to be deliberate.
What we do:
Reading is free, acting asks. A guard hook sits in front of the agent's tools. It does not ask permission to read anything. It asks before exactly three classes of action: moving money, deleting accounts, and sending a message on our behalf. Those three cover almost everything we would regret.
Third party skills are treated as untrusted input, not as software. A skill is a text file that tells a model what to do. It arrives with the same trust level as an email from a stranger.
Client data does not go where we have not read the data processing terms. This sounds obvious. In practice it is the constraint that kills most otherwise attractive integrations, and the answer is often that a vendor's storage region and its processing region are not the same thing.
No autonomous external communication. The agent drafts. A human sends. We have not found a framing of this that we would defend to a client, and until we do, the rule stands.
Anything where being wrong is expensive and being slow is cheap. Structural judgments. Anything that goes into a building permit application. Anything where a professional signature carries liability. The technically responsible person in our office is an architect with more than two decades in public building administration, and the division of labour is simple: the machine gathers, the human decides and signs.
We also do not use it as a search engine for things we could look up ourselves in less time than it takes to explain the question.
Our work depends on German municipal council records: which school gets renovated, which budget passed, which committee owns a file. That is public by law and sits in council information systems, most of which expose a machine readable interface called OParl. Getting at it properly took us a while, mostly because the existing libraries are unmaintained and the public endpoint registry is stale.
So we packaged that as a skill and published it on ClawHub. It does one thing, it documents where it fails, and it is polite to municipal servers by default, because several towns share one machine and a careless crawler is a real cost to somebody.
One decision inside it is worth naming. OParl also exposes email addresses and phone numbers of elected council members. The skill deliberately does not output them. German administrative case law (BVerwG, 29 January 2025, 6 C 3.23) holds that publication for one purpose does not license contact for another, and German competition law requires prior explicit consent for commercial email even towards businesses and public bodies. A field being in an API response is not permission. Agents are very good at turning available data into contact attempts, and that is precisely the capability you do not want running unattended.
Before publishing we also put a deliberately hostile second pass over our own code. It found three real defects that a green test suite had not: a fetcher that accepted any URL scheme and could therefore be pointed at file:///, link following that would leave the named host, and output escaping that covered commas but not newlines in a format that is quietly semantic. All three are written up, with the generalisations, in a separate hardening note we have given to the Foundation to use as it sees fit.
OpenClaw did not transform our business. It removed a category of small, attention shaped work that used to eat an hour a day and was done badly because nobody wants to do it. That is worth a great deal and it is less than the marketing around agents suggests.
The hard part was never the model. It was deciding what the thing is allowed to touch, and writing that down before finding out the expensive way.
Alpha Quadrat Bauplanung & Projektmanagement UG (haftungsbeschränkt), Wuppertal. Nothing in this post is an endorsement by the OpenClaw Foundation, and nothing here has been reviewed or confirmed by them.
FACHLICH VERANTWORTET
Lazaros Amperidis, Dipl.-Ing. Architekt (AKNW)
Mitglied der Architektenkammer NRW (Mitgliedsnr. 32316), bauvorlageberechtigt, Wuppertal. Die Anerkennung als staatlich anerkannter Sachverständiger für Schäden an Gebäuden ist in Vorbereitung (angestrebt voraussichtlich ab November 2026). Er verantwortet die fachlichen Inhalte und jede Gutachtenfreigabe persönlich.
MEINUNGSBEITRAG DES GENANNTEN AUTORS. ALLGEMEINE EINORDNUNG, KEINE VERBINDLICHE BERATUNG IM EINZELFALL.
