How Z47 deployed secure, production-ready OpenClaw agents to their entire org
One agent per team member. Every credential isolated. Every action traceable. Zero plaintext secrets anywhere in the stack.
An agent-first operating model, built for a firm that moves at founder speed
Z47 is one of India's most active venture firms: $3.5Bn AUM, 100+ companies, 10 unicorns. They leaned into AI agents as infrastructure early, not experimentation.
The bet: every team member gets an agent that knows their context, inbox, and data. WhatsApp as the interface, since the firm already lives there. The hard part wasn't adoption. It was running it safely at org scale with real credentials on the line.
A personal AI, on WhatsApp
A team member sends a message. Their agent, running in its own session on their own accounts, handles it. Click a category to see an example.
Pull a portfolio summary
Agent reads their Attio pipeline and drafts a summary from their deals, not shared data.
Catch up on email
Agent reads their Gmail or Outlook and surfaces threads that need a response. Actions are attributed to them.
Pre-meeting intelligence
Agent pulls Notion notes, Affinity relationship history, and live web context via Brave Search.
Log work and projects
Agent updates Harvest entries, files them under the right project, as the person who sent the message.
OpenClaw routes and executes. Scalekit handles everything else.
The architecture separates concerns cleanly. OpenClaw routes incoming messages and runs each agent in its own sandbox. Scalekit handles the auth: identity, credential vault, and tool calls into every connected service.
Team members message a shared WhatsApp number. Every action is scoped to them: their credentials, their accounts, their permissions. Nothing shared, nothing crossed.
The sandbox holding your agent never touches a real token. It holds only a Scalekit client ID. Scalekit resolves the rest at runtime.
- team member
- sends message
OpenClaw
- lookup phone number
- route to sandbox
- spin up if needed
- pass message in
Sandbox
- holds: client_id only
- no tokens or secrets
- calls Scalekit SDK
Scalekit
- resolve user identity
- fetch scoped token
- execute tool call
- return result
- log audit event
- per-agent rate limits
OpenClaw routes and isolates
OpenClaw identifies the sender's phone number, routes to their isolated sandbox, and spins it up if needed. The agent reasons about the task and makes tool calls scoped entirely to that user. No cross-agent visibility. No shared state.
Scalekit secures and executes
The sandbox holds only a Scalekit client ID. No tokens, no API keys, no shared secrets. Scalekit validates delegated auth, enforces scoped permissions, executes the tool call, and returns a clean result. The agent never touches a credential directly.
Every agent connected to the tools that person actually uses
Each team member's agent connects to their own accounts across every service, not shared service accounts. Scalekit manages the OAuth tokens, scopes, and refresh cycles per user, per app.
Relationship intel
Mail & calendar
Research & notes
Time & projects
From zero to connected in minutes, over WhatsApp
No IT ticket. No admin intervention. No hardcoded tokens. When a new team member sends their first message, the agent handles the entire onboarding flow over WhatsApp.
Message arrives
Team member sends a message. OpenClaw creates their sandbox. Agent identifies a tool that hasn't been authorized yet.
Magic link generated
Scalekit generates a per-user, per-service magic link. The agent sends it back over WhatsApp.
OAuth completed
User taps the link, completes the OAuth flow in their browser. Scalekit captures and stores the token scoped to their account.
Agent proceeds
From here on, every call for that service uses their credentials automatically. No repeat steps. No maintenance overhead.
Isolated by design. Bounded blast radius.
The original deployment had a structural gap: the central OpenClaw config file contained plaintext credential values any agent could read. A single compromised agent could expose every other agent's keys.
Scalekit closes that gap. Each sandbox gets a unique client ID stored only in its own environment file. No shared config. No cross-agent credential visibility. If an agent is suspended, only that client ID is revoked. Every other agent keeps running.
Z47's framing was direct: at some point, an agent would be compromised. The question wasn't whether. It was how to contain the damage when it happened.
No shared credentials
The central OpenClaw config holds only Scalekit identifiers, never token values. No agent can read another agent's credentials by design.
Per-agent client IDs
Each sandbox gets a unique Scalekit client ID and secret. Suspension is instant and surgical: one ID, one agent, zero collateral.
Full audit trail
Every tool call is logged: which agent, which user, which action, which service. Full visibility into what happened and on whose behalf.
"We'd actually paused rollout because we weren't confident in the security model. Scalekit gave us the identity layer we needed to start again. Every agent now acts as its own user, and we can see and control exactly what each one can do."
From paused rollout to full org deployment in under a week
From stalled to running across the firm, with credentials handled per person and nothing shared.
A blueprint for internal multi-user agents
Z47's deployment is an instance of a pattern any org deploying AI agents internally will need to solve: how do you give every team member their own agent, with their own credentials, permissions, and audit trail, without building custom identity infrastructure from scratch? The answer is a clean separation of concerns. The agent framework handles execution. The identity layer handles everything else.
Agent execution framework
Per-user session isolation behind one WhatsApp number. OpenClaw gives you this out of the box: one process, N isolated agents, no cross-agent state.
Credential isolation + delegated auth
Scalekit decouples secret storage from the agent runtime entirely. Sandboxes hold client IDs, not tokens. Scalekit validates auth, enforces scoped permissions, executes tool calls.
Per-user connected accounts
OAuth managed per user, per app. Every action taken as the person who triggered it, not a shared bot with org-wide access.
Building internal agents on OpenClaw?
Scalekit handles credential isolation, delegated auth, scoped permissions, and tool calls. Ship production-ready agents without building auth infrastructure from scratch.
