Brex built its AI agent policy by watching what agents actually do, not by writing rules first

OpenClaw has become one of the most widely adopted agentic frameworks, but it has yet to prove itself at enterprise scale. Agents need real credentials — API keys, OAuth tokens, service accounts — to work effectively, and Brex found that traditional guardrails couldn’t contain what those agents were doing with them. Brex set out to overcome these limitations by building an internal platform it calls CrabTrap.