🦞 OpenClaw Bootcamp
DAY 15 / 16
🦞🦞🦞
OpenClaw Bootcamp · Day 15

Multi-Agent:
Orchestrate Your Team

One agent is powerful. Multiple specialized agents working together is infrastructure. Today you stop running a solo assistant and start running a coordinated team — each agent with its own workspace, its own tools, and its own role.

Multi-Agent Architecture Routing & Bindings Agent-to-Agent Comms
🦞 OpenClaw Bootcamp
DAY 15 / 16
Where We Are & Where We’re Going

Day 15 Goals

Day 14 Checkpoint
  • Agentic coding with build logs and align-before-build prompting
  • Sub-agent patterns for background delegation
  • Spawning, steering, and managing sub-agent lifecycles
01
Understand multi-agent architecture: isolated workspaces, agentDir, session stores
02
Master routing precedence and channel bindings to direct traffic to the right agent
03
Configure agent-to-agent communication and enforce per-agent security isolation
🦞 OpenClaw Bootcamp
DAY 15 / 16
The Architecture

One Gateway, Many Agents

📂

Agent Directory

~/.openclaw/agents/<agentId>/agent/ for auth profiles and config. sessions/ for conversation history. Each agent = isolated state.

📁

Workspace

~/.openclaw/workspace-<agentId>/ per agent. Own AGENTS.md, SOUL.md, MEMORY.md, tools, and skills. Complete isolation from other agents.

CLI Management

openclaw agents add to create, openclaw agents list to view, openclaw agents delete to remove. Clean lifecycle management.

Critical Rule

Never reuse agentDir across agents. Each agent must have its own directory for auth profiles, model registry, and session state. Sharing causes auth collisions and session corruption.

🦞 OpenClaw Bootcamp
DAY 15 / 16
Traffic Control

Routing & Bindings

Deterministic Precedence

Routing follows strict priority order. First match wins:

  • 1peer — exact user match (kind + id)
  • 2parentPeer — parent context match
  • 3guildId + roles — server + role combo
  • 4guildId — server-wide match
  • 5teamId — team-level match
  • 6accountId — account-level match
  • 7channel-wide — all traffic on a channel
  • 8default — fallback agent
Bindings in openclaw.json

Match fields: channel, accountId, peer (kind + id), guildId, roles.

// Multiple match fields = AND "bindings": [{ "channel": "discord", "guildId": "123456", "roles": ["admin"], "agentId": "admin-bot" }]
Tie Breaking

When multiple bindings match at the same precedence tier, config order wins — the first binding listed in openclaw.json takes priority.

🦞 OpenClaw Bootcamp
DAY 15 / 16
Per-Agent Setup

Agent Configuration

agents.list[] Properties
"agents": { "list": [{ "id": "support-bot", "name": "Support Agent", "workspace": "~/.openclaw/ws-support", "agentDir": "~/.openclaw/agents/support", "model": "claude-sonnet-4-20250514", "default": false, "identity": "Support specialist", "sandbox": { "mode": "all" } }]}
Never Reuse agentDir

Each agent must have a unique agentDir. Sharing directories between agents causes auth-profiles.json collisions and corrupted session state.

Tools, Skills & Group Chat
  • tools.allow / tools.deny — per-agent tool access control
  • skills — skill allowlists per agent
  • groupChat.mentionPatterns — trigger patterns in group contexts
  • memorySearch — configure search backend per agent
agents.defaults

Set shared baseline config under agents.defaults. Individual agents inherit these values and can override any property. Use defaults for model, sandbox mode, and common tool policies.

🦞 OpenClaw Bootcamp
DAY 15 / 16
Platform Specifics

Channel Routing Examples

💬

Discord

One bot per agent. Message Content Intent required. Bind by peer for DMs, guildId for server-wide, roles for Discord role-based routing.

Telegram

One bot per agent via BotFather. Bind by peer for DM routing, guildId for group-wide routing. Each bot token maps to one agent.

📱

WhatsApp

Login with openclaw channels login --channel whatsapp --account <id>. Multi-account: channels.whatsapp.accounts with authDir per account.

Binding by Peer

Route specific users to specific agents via peer: { kind: "user", id: "..." }. Highest precedence — always wins over server or channel bindings.

Multi-Account

Run multiple WhatsApp accounts by defining each under channels.whatsapp.accounts with a separate authDir per account.

🦞 OpenClaw Bootcamp
DAY 15 / 16
Cross-Agent Coordination

Agent-to-Agent Communication

Disabled by Default

Agent-to-agent communication is off until you explicitly enable it. Opt-in per agent with an allowlist:

"tools": { "agentToAgent": { "enabled": true, "allow": ["agent1", "agent2"] } }
Session Isolation

Sessions are keyed as agent:<agentId>:<mainKey>. Each agent maintains its own conversation history, even when communicating with the same user.

Cross-Agent Memory

Let agents search each other’s memory stores without sharing session context:

"memorySearch": { "qmd": { "extraCollections": [ "agent1-memory", "agent2-memory" ] } }
Design Principle

Communication is explicit and auditable. Agents can only talk to agents on their allow list, and cross-agent memory access is read-only. No implicit sharing, no hidden state transfer.

🦞 OpenClaw Bootcamp
DAY 15 / 16
Hardening

Security & Isolation

Per-Agent Controls
  • Sandbox — per-agent sandbox mode (off, non-main, all)
  • Tool allow/deny — restrict tools per agent
  • Skill allowlists — limit which skills each agent can use
  • Own auth-profiles.json — each agent gets its own credentials
Sandbox Escape

Relative paths stay inside the workspace. Absolute paths breach the sandbox. If an agent can write to an absolute path outside its workspace, sandbox isolation is meaningless. Audit your tool configs.

Session Boundaries

DM sessions collapse to main per agent. Each agent sees only its own session history. Cross-agent sessions are keyed separately — no bleed-through between agents handling the same user.

True Isolation Pattern

For maximum isolation: one agent per person. Each user gets a dedicated agent with its own workspace, memory, session store, and auth. This is the gold standard when data separation is non-negotiable.

Never Share agentDir

This bears repeating: sharing agentDir between agents is the most common multi-agent misconfiguration. It causes silent auth collisions and session corruption that are extremely difficult to debug.

🦞 OpenClaw Bootcamp
DAY 15 / 16
Before Day 16

Day 15 Homework

  • 01

    Add a Second Agent

    Run openclaw agents add to create a new agent with its own ID, workspace, and agentDir. Verify it appears in openclaw agents list. Make sure the agentDir is unique.

  • 02

    Bind It to a Different Channel

    Configure a binding in openclaw.json so your new agent handles a specific channel, server, or user. Test that messages route to the correct agent based on your binding rules.

  • 03

    Configure Different Tools & Skills per Agent

    Give each agent a different tool allow/deny list and different skill allowlists. One agent might have full exec access while the other is read-only. Verify the restrictions hold.

  • 04

    Test Routing

    Send messages from different channels, users, or roles and confirm the routing precedence matches what you configured. Check that the default agent handles unmatched traffic.

🦞 OpenClaw Bootcamp
DAY 15 / 16
🦞
Coming Up

Day 16: Workspace Files
The Complete Reference

You’ve built the full stack — personality, memory, tools, skills, heartbeats, sub-agents, and now multi-agent orchestration. Day 16 ties it all together with the complete workspace files reference. Every file, every config, every interaction — one definitive guide to running your OpenClaw system in production.

Full Reference Production Config Bootcamp Finale