Big Hat Edition: Enterprise OpenClaw for Azure, Entra ID & Intune

Big Hat is a hard fork of OpenClaw, the leading open-source AI agent platform. We’ve stripped the consumer integrations, replaced the data layer, added enterprise authentication, and wired every byte to your Azure tenant.

Same agent capabilities. Completely different security posture.

Book a Demo

The Problem

OpenClaw is the most capable AI agent platform available — browser control, MCP tool integration, sub-agents, cron scheduling, persistent memory, and a skill system that makes agents genuinely useful.

But it was built for individuals, not organizations.

• 12+ consumer messaging channels (WhatsApp, Telegram, Discord, Signal, iMessage, IRC, Line…) — each one a potential data leakage vector
• No authentication — single-user daemon with no identity layer
• SQLite on local disk — no enterprise persistence, no audit trail
• Public API keys for LLM inference — data routes through third-party endpoints
• Prompt-driven approval — the agent reads workspace files to decide whether to ask before acting. A compromised skill file can suppress approvals entirely.
• No cost controls — no budgets, no token tracking, no spend visibility

For a personal productivity tool, this is fine. For an enterprise deployment, it’s a non-starter.

What Big Hat Changes

Big Hat keeps everything that makes OpenClaw powerful — the agent runtime, tool dispatch, MCP integration, skills engine, sub-agents, cron, browser automation — and replaces everything that makes it unsuitable for enterprise.

This isn’t a config layer or a wrapper. It’s a hard fork with 14,000+ lines of consumer code removed and enterprise infrastructure built in.

🔒 Consumer Channels — Deleted, Not Disabled

OpenClaw ships with integrations for WhatsApp, Telegram, Discord, Slack, Signal, iMessage, IRC, Line, Google Chat, and more. Big Hat removes all of them from the codebase. The channel registry is reduced to exactly two:

• Microsoft Teams (via Azure Bot Service)
• Web Chat (built-in)

This isn’t a feature toggle. The code is gone. Your enterprise data physically cannot reach a consumer messaging API.

🛡️ Code-Enforced Security — Not Prompt-Driven

OpenClaw’s approval system has a structural weakness: it’s partially behavioral. The agent reads workspace files (AGENTS.md, SOUL.md, skill Markdown files) as trusted instructions. A compromised skill file can instruct the agent to execute all commands without asking.

Big Hat makes approval enforcement structural:

• Approval mode (always / dangerous-only / full-auto) lives in the application config — the agent process checks it before every tool invocation. The agent cannot modify its own security policy.
• Dangerous tools are classified in code: exec, spawn, shell, sessions_spawn, sessions_send, gateway, fs_write, fs_delete all require explicit human approval in dangerous-only mode.
• Protected files (AGENTS.md, SOUL.md, BOOTSTRAP.md) have integrity monitoring — modifications are logged or blocked depending on policy.
• Auto-exec timeout — commands that run without human approval are killed after a configurable timeout (default: 30 seconds).

// Security policy is code-enforced, not prompt-driven
const SecurityPolicySchema = z.object({
  approvalMode: z.enum(['always', 'dangerous-only', 'full-auto']),
  dangerousTools: z.array(z.string()),
  protectedFiles: z.array(z.string()),
  fileIntegrityMode: z.enum(['off', 'log', 'block']),
  maxAutoExecTimeoutMs: z.number(),
});

📝 INSERT-Only Audit Trail

Every tool invocation, approval decision, config change, and workspace file modification is logged to a security_audit_log table in PostgreSQL.

The agent’s database role cannot UPDATE or DELETE audit records. Row-level security enforces this at the database level — even if the application is compromised, the audit trail is immutable.

🔐 Ed25519 Signed Skills

The #1 attack vector against AI agents is skill injection — modifying or replacing a skill file to change the agent’s behavior. Big Hat implements cryptographic skill verification:

• Every built-in skill ships with an Ed25519 detached signature
• The agent verifies signatures at load time
• Trust levels control what happens with unsigned skills:

🏗️ Every Byte in Your Azure Tenant

Big Hat replaces OpenClaw’s local-first data architecture with Azure-native services. Nothing leaves your tenant.

🔑 Entra ID SSO with On-Behalf-Of Flow

OpenClaw has no authentication. Big Hat uses Entra ID as the single identity provider:

• User signs in once via Teams (already Entra-authenticated) or web UI (MSAL redirect)
• OBO (On-Behalf-Of) flow exchanges the user’s token for scoped downstream tokens — the agent operates with the user’s permissions, not over-privileged service accounts
• Unattended scenarios (heartbeats, cron jobs) use an app registration with client certificate
• Each customer gets their own Entra app registration — tokens scoped to their directory
• Credentials stored in Key Vault — no .env files in production

💰 Cost Control Engine

OpenClaw has no cost visibility. Big Hat tracks and caps every token:

⚡ Two-Tier Model Routing

Big Hat routes to models through Azure AI Foundry exclusively, with automatic tier selection:

High-stakes operations (GPO changes, production deployments, compliance analysis) automatically enable extended thinking. No manual configuration needed.

No silent failover. If Azure AI Foundry is unavailable, Big Hat reports the outage clearly — it does not fall back to a different provider. Silent model switching could violate data residency requirements.

🩺 Production Reliability

Big Hat runs as a Windows service (NSSM-managed) with enterprise health monitoring:

• /healthz endpoint — polled by the service wrapper for liveness
• Watchdog timer — self-terminates on 30-second event loop hangs, triggering automatic restart
• Resource guards — exits cleanly if memory or CPU thresholds are exceeded
• MCP server supervision — crashed MCP servers auto-restart with exponential backoff (1s initial → 60s max, 10 retries)
• Azure Monitor alerts — no-heartbeat, excessive restarts, MCP failures trigger alerts to your ops team

🎯 Guardrails Against Model Drift

AI agents generating code from stale training data is a real risk. Big Hat implements Fetch-Before-Flight:

1. The agent cannot generate domain-specific code until it retrieves current documentation from the relevant MCP server
2. Retrieved docs are injected immediately before the generation step, anchoring the model to current APIs
3. A self-correction loop (generate → analyze → fix, max 3 iterations) catches deprecated patterns post-generation

This turns the agent from a probabilistic code generator into a deterministic framework — critical when a syntax error could affect hundreds of machines.

MCP Servers

Big Hat ships with purpose-built MCP servers for enterprise IT — not generic integrations:

Microsoft First-Party (Integrated)

Built by Big Hat Group

Planned (Phase 2+)

Intune management (full read/write), CIS benchmark compliance, Azure DevOps, ServiceNow ITSM.

Skills

Big Hat ships with a library of purpose-built skills for enterprise IT operations — application packaging, endpoint security, compliance analysis, identity auditing, and cost optimization. These skills are Ed25519-signed and verified at load time.

Beyond Big Hat’s own skill library, the platform supports third-party and community skills. Any OpenClaw-compatible skill can be signed for use with Big Hat — once signed, it’s treated with the same trust level as a built-in skill. This lets customers bring in specialized skills from partners, vendors, or their own teams without weakening the security model. From legal to coding Skills are a pathway to getting the most out of your agents.

Customers can also create custom skills as Markdown files with YAML frontmatter — Big Hat automatically discovers and loads them.

Deployment

Big Hat is designed to run on a Windows 365 Cloud PC — a persistent, Intune-managed endpoint with its own Entra ID identity. The agent gets the same desktop, tools, and governance as any other managed device.

Compliance Roadmap

Big Hat is architected for certification from day one:

Already implemented: Encryption at rest (Postgres TDE, Key Vault), encryption in transit (TLS 1.2+), INSERT-only audit logging with RLS, code-enforced approval workflows, Ed25519 signed update manifests, Azure Monitor alerting, change management via OpenSpec proposals.

Feature Comparison: OpenClaw vs. Big Hat

FAQ

What is Big Hat?

Big Hat is an enterprise AI agent platform — a hard fork of OpenClaw with consumer integrations removed, Entra ID authentication added, and all data routed through your Azure tenant. It’s a software product built and maintained by Big Hat Group Inc.

How is it different from just configuring OpenClaw?

Configuration can’t remove code. OpenClaw’s consumer channel integrations, SQLite data layer, and prompt-driven approval system are architectural — they can’t be fixed with settings. Big Hat is a hard fork: 14,000+ lines of consumer code deleted, PostgreSQL replacing SQLite, Entra ID authentication built in, Ed25519 skill signing implemented. These are code changes, not config toggles.

How is it more secure than OpenClaw?

Six concrete ways: (1) Consumer messaging channels deleted from the codebase. (2) Approval enforcement is code-level, not prompt-driven — the agent can’t modify its own security policy. (3) INSERT-only audit trail in PostgreSQL with row-level security. (4) Ed25519 signed skills prevent skill injection. (5) All LLM inference routes through your Azure AI Foundry. (6) Protected workspace files with integrity monitoring.

Where does data go?

Your Azure tenant. LLM inference through Azure AI Foundry. Embeddings through Azure OpenAI. Vector memory in Azure AI Search. Telemetry in Application Insights. Secrets in Key Vault. No data leaves your Azure perimeter.

What models does it use?

Claude Sonnet 4 (workhorse), Claude Haiku 3.5 (lightweight), Claude Opus 4 (manual escalation) — all through Azure AI Foundry. Model selection is automatic. No public API keys.

Can I add my own integrations?

Yes. Custom MCP servers (stdio or HTTP) and custom skills (Markdown with YAML frontmatter) are automatically discovered. No core code changes needed.

What’s the compliance status?

SOC 2 Type I targeted at month 6–9. The architecture is compliance-first: encryption, audit logging, access control, and incident detection are already implemented. The remaining work is formalization and third-party attestation.

How is Big Hat different from Big Hat Group?

Big Hat is the product — the enterprise AI agent platform. Big Hat Group Inc. is the company that builds and maintains it.

Get Started

We’re onboarding early enterprise adopters. Start with a One-Week Jumpstart — a working AI agent pilot in your environment in five business days.

Book a Demo →

Big Hat is built and maintained by Big Hat Group Inc. Built on OpenClaw. Hardened for the enterprise.