How to Set Up OpenClaw for a Team of 50+

# Option 1: Shared Multi-Tenant Instance
# Pros: Simple, cheap, centralized
# Cons: Noisy neighbors, shared resources, harder isolation
#
# [All 50 users] → [Single OpenClaw Instance]
#
# Recommended for: Small teams (<20), tight budgets

# Option 2: Per-Team Dedicated Instances
# Pros: Isolation, independent scaling, team autonomy
# Cons: More infrastructure, higher cost, harder updates
#
# [Engineering Team] → [OpenClaw Instance 1]
# [Marketing Team]   → [OpenClaw Instance 2]
# [Sales Team]       → [OpenClaw Instance 3]
#
# Recommended for: Large teams (50+), distinct use cases

# Option 3: Hybrid (Shared + Premium Dedicated)
# Pros: Cost-effective for most, premium tier for power users
# Cons: Complex routing, two classes of service
#
# [Most users] → [Shared Instance]
# [Power users] → [Dedicated Premium Instance]
#
# Recommended for: Mixed usage patterns, budget-conscious

# Architecture decision matrix:
# Team size | Shared | Per-Team | Hybrid
# < 20      | ✓      |          |
# 20-50     |        |          | ✓
# 50+       |        | ✓        |

# In config/auth/sso.yaml:
sso:
  enabled: true
  provider: okta  # or "azure-ad", "google-workspace", "onelogin"

  okta:
    domain: company.okta.com
    client_id: YOUR_CLIENT_ID
    client_secret: YOUR_CLIENT_SECRET
    redirect_uri: https://openclaw.company.com/auth/callback

  # User provisioning:
  provisioning:
    auto_create_users: true
    auto_assign_license: true
    default_role: user

  # Group mapping:
  group_mapping:
    "engineering": team_engineering
    "marketing": team_marketing
    "admins": openclaw_admins

  # Session management:
  session:
    timeout: 8h
    refresh_token: true
    force_reauth: 30d

# Test SSO integration:
openclaw admin auth test-sso --provider okta

# In config/budgets/limits.yaml:
budgets:
  # Organization-wide monthly budget:
  organization:
    monthly_limit: 10000.00
    currency: USD
    alert_threshold: 0.8  # Alert at 80%

  # Per-team budgets:
  teams:
    engineering:
      monthly_limit: 5000.00
      daily_limit: 200.00
      per_user_limit: 100.00

    marketing:
      monthly_limit: 2000.00
      daily_limit: 80.00
      per_user_limit: 40.00

    sales:
      monthly_limit: 1000.00
      daily_limit: 40.00
      per_user_limit: 20.00

  # Per-user budget overrides:
  users:
    alice@company.com:
      monthly_limit: 500.00  # Power user
    bob@company.com:
      monthly_limit: 50.00   # Limited user

  # Budget enforcement:
  enforcement:
    hard_limit: true  # Block requests when budget exceeded
    grace_period: 24h
    notify_user: true
    notify_admin: true

# View budget usage:
openclaw admin budgets usage --team engineering --range 30d

# Set budget for new team:
openclaw admin budgets set --team sales --monthly 1000

# For Ansible deployment (see separate guide):
ansible-playbook -i inventory/production.ini deploy-openclaw.yml

# For Kubernetes deployment:
# In k8s/openclaw-deployment.yaml:
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw
spec:
  replicas: 3  # 3 instances for HA
  selector:
    matchLabels:
      app: openclaw
  template:
    metadata:
      labels:
        app: openclaw
    spec:
      containers:
      - name: openclaw
        image: openclaw/openclaw:2.1.0
        resources:
          requests:
            memory: "2Gi"
            cpu: "1000m"
          limits:
            memory: "4Gi"
            cpu: "2000m"
        env:
        - name: OPENCLAW_CONFIG
          value: /config/openclaw.yaml
        volumeMounts:
        - name: config
          mountPath: /config
      volumes:
      - name: config
        configMap:
          name: openclaw-config

# Deploy to Kubernetes:
kubectl apply -f k8s/openclaw-deployment.yaml
kubectl apply -f k8s/openclaw-service.yaml
kubectl apply -f k8s/openclaw-ingress.yaml

# In docs/onboarding/README.md:
# OpenClaw Onboarding Guide

## Getting Started
1. Visit https://openclaw.company.com
2. Click "Sign in with SSO"
3. Use your company email and password
4. Complete 5-minute interactive tutorial

## Your First Conversation
- Type: "Help me write a Python script to process CSV files"
- OpenClaw will guide you through the task

## Common Use Cases
- Code review: "Review this pull request for bugs"
- Documentation: "Generate API docs for this Python module"
- Debugging: "Why is this function failing?"

## Budget and Limits
- You have a $100/month budget
- View usage: Click your profile → Usage Dashboard
- Questions? Contact #openclaw-support

# In config/onboarding/tutorial.yaml:
tutorial:
  enabled: true
  required_for_new_users: true

  steps:
    - id: welcome
      title: "Welcome to OpenClaw"
      content: "Let's learn the basics in 5 minutes"
    - id: first_message
      title: "Send your first message"
      prompt: "Ask me to explain what I can do"
    - id: code_request
      title: "Try a code task"
      prompt: "Ask me to write a Python function"
    - id: review
      title: "Review and edit"
      content: "You can edit my code, ask follow-ups, or start over"
    - id: complete
      title: "You're ready!"
      content: "Explore documentation at docs.company.com/openclaw"

# In config/governance/policies.yaml:
governance:
  # Acceptable Use Policy:
  acceptable_use:
    prohibit_personal_use: true
    prohibit_sensitive_data: true
    require_data_classification: true

  # Data retention:
  retention:
    conversation_history: 90d
    audit_logs: 365d
    deleted_sessions: 30d

  # Content filtering:
  content_filter:
    enabled: true
    block_pii: true
    block_secrets: true  # API keys, passwords
    block_offensive: true

  # Compliance:
  compliance:
    gdpr: true
    hipaa: false  # Set true if handling health data
    sox: false    # Set true if handling financial data

  # Audit logging:
  audit:
    log_all_requests: true
    log_retention: 365d
    export_format: json
    export_schedule: weekly

# In config/governance/terms.md:
# Terms of Use for OpenClaw

By using OpenClaw, you agree to:
- Use only for company business
- Not share API keys or credentials
- Not input sensitive personal data (SSN, health records)
- Follow company data classification policies

Violations may result in access revocation.

# Show acceptance modal on first login:
# In config/onboarding/terms.yaml:
terms:
  require_acceptance: true
  version: "2025-01-25"
  url: /docs/terms-of-use

# In config/monitoring/dashboard.yaml:
monitoring:
  platform: grafana

  grafana:
    url: https://grafana.company.com
    dashboard_id: openclaw-overview

  metrics:
    - name: active_users
      query: 'count(openclaw_active_sessions)'
    - name: request_rate
      query: 'rate(openclaw_requests_total[5m])'
    - name: cost_burn_rate
      query: 'rate(openclaw_cost_usd[1h])'
    - name: error_rate
      query: 'rate(openclaw_errors_total[5m])'

  alerts:
    - name: high_cost_burn
      condition: cost_burn_rate > 100
      severity: critical
      notify: slack
    - name: high_error_rate
      condition: error_rate > 0.05
      severity: warning
      notify: email
    - name: budget_exceeded
      condition: team_budget_usage > 0.9
      severity: warning
      notify: team_admin

# Access dashboard:
# Visit: https://grafana.company.com/d/openclaw-overview

# Set up Slack alerts:
# In config/monitoring/slack.yaml:
slack:
  webhook_url: https://hooks.slack.com/services/YOUR/WEBHOOK
  channel: #openclaw-alerts
  mention_on_critical: "@oncall"