Treat OpenClaw as untrusted intern with Persistent Id and Ephemeral credentials