---
description: Confirm target role and workspace before execution or authorization prompts
alwaysApply: true
---

# Role Confirmation

- For any execution, approval, token, service, network, Nginx, Docker, firewall, pairing, or gate-authorization request, first confirm the target role and current workspace.
- The prompt or response must make the target role explicit, for example: `Target role: PC_EXECUTOR in D:\openclaw-control-plane`.
- If the current window role does not match the target role, stop and ask the user to resend the prompt to the correct role/window.
- Verifier roles must not perform ORCHESTRATOR or EXECUTOR work unless explicitly reassigned by the user and reflected in the control-plane files.
- Execution agents may act only from their assigned task file and handoff. If task status is `blocked`, `draft`, or ambiguous, do not execute.
- Sensitive authorization must echo the exact allowed action and forbidden actions before proceeding.
- Never treat a broad phrase like "go ahead", "continue", or "OK" as authorization for token handling, node run, approve, service changes, or infrastructure mutation.