How Z47 shipped secure OpenClaw agents firm-wide.
Z47 — formerly Matrix Partners India — manages $3.5Bn across 100+ portfolio companies and 10 unicorns. They treat AI agents as production infrastructure, not pilots.
Every team member runs their own OpenClaw agent on their own data. Adoption was easy. Running it safely at org scale, with real credentials in play, was the unsolved problem.
"We paused rollout because we weren't confident in the security model. Scalekit gave us the identity layer to ship with confidence. Every agent now acts as its own user, and we can see and control exactly what each one can do."
One agent per person — scoped to their work, their tools, their data.
Every message stays scoped to the sender. The agent runs in their session, acts on their accounts, and every tool call is attributed to them.
Pull a portfolio summary
Reads each user's Attio pipeline and drafts a tailored summary from their own deals — no shared data leakage.
Catch up on email
Scans the user's Gmail or Outlook inbox and surfaces threads that need a response, ranked by urgency.
Pre-meeting intelligence
Pulls notes from Notion, relationship history from Affinity, and live web context via Brave — all under the user's own permissions.
Run prospecting and outreach flows
Triggers Phantombuster flows for sourcing and outreach, attributed to the person who sent the message.
OpenClaw routes the message. Scalekit executes the call.
OpenClaw runs every agent inside its own per-user sandbox. Scalekit owns the identity layer, the credential vault, and every tool call leaving the agent. The sandbox never sees a real token.
- Team member sends message
OpenClaw
- Looks up phone number
- Routes to user sandbox
- Spins one up if missing
- Passes message in
Sandbox
- Holds client ID only
- No tokens or secrets stored
- Calls Scalekit SDK
Scalekit
- Resolves user identity
- Fetches scoped token
- Executes tool call
- Returns result to agent
- Logs audit event
- Enforces rate limits
NotionGmailOutlookAttioAffinityBraveGranolaPhantombusterEvery agent connects to the tools that person actually uses.
Each agent authenticates with the user's own accounts via OAuth — never a shared service principal. Scalekit scopes tokens per user, per app, and refreshes them silently in the background.
Relationship intel
Mail & calendar
Research & notes
Trackers & ops
New agents onboard in minutes — no IT ticket required.
When a new team member sends their first message, Scalekit generates per-service magic links. They tap once, complete OAuth, and the agent picks up where it left off — no admin intervention, no hardcoded tokens.
Message arrives
Team member sends their first message. OpenClaw spins up their sandbox and flags any tools the agent isn't authorized to use yet.
Magic link sent
Scalekit generates a per-user, per-service magic link. The agent delivers it back over WhatsApp.
OAuth completed
User taps the link and finishes OAuth in their browser. Scalekit captures the token, scoped to that account.
Agent proceeds
From here on, every call uses that user's credentials automatically. Zero maintenance, zero repeat steps.
Isolated by design.
Bounded blast radius.
The original deployment had a structural flaw: OpenClaw's config file held plaintext credentials any agent could read. A single compromised agent meant every other agent's keys were exposed.
Scalekit closes the gap. Each sandbox holds only a unique client ID — never a real token. Suspend one ID, every other agent keeps running.
No shared credentials
OpenClaw's central config holds only Scalekit identifiers — never raw tokens. No agent can read another agent's credentials by design.
Per-agent client IDs
Every sandbox gets a unique Scalekit client ID. Suspension is instant and surgical: revoke one ID, every other agent keeps running.
Full audit trail
Every tool call is logged: which agent, which user, which action, which service. Total visibility into what happened — and on whose behalf.
The blueprint for any multi-user agent system.
Every team member gets their own agent, their own credentials, and their own audit trail — without building identity infrastructure from scratch. The agent framework handles execution. Scalekit handles everything else.
Agent execution framework
Per-user session isolation across one shared runtime. OpenClaw delivers this out of the box: one process, N isolated agents, no cross-agent state.
Credential isolation + tool execution
Scalekit decouples secret storage from the agent runtime entirely. Sandboxes hold client IDs, not tokens — Scalekit resolves identity, fetches scoped tokens, and executes the tool call.
Per-user connected accounts
OAuth managed per user, per app. Every action taken as the person who triggered it — never a shared bot with org-wide access.
Building multi-user agents of your own?
Resolve identity, scope permissions, execute tool calls — across 20+ services. Ship production agents without building the layer yourself.
