docs: require openclaw deployment account

Author: steipete

AGENTS.MD

@@ -23,6 +23,7 @@ Codex CLI output: avoid Markdown tables by default; they render poorly there. Us
 - Secrets/API keys/live creds: use `$one-password`; env only if already exported; `op` is skill/tmux-only, no broad enumeration/secret output.
 - New API keys: immediately store in 1Password service account via `$one-password`; temp files/env only for current task.
 - Email/Google account for testing: use `gog+clawdbot@gmail.com`.
+- OpenClaw deployments: use `service@openclaw.org` accounts only.
 
 ## Project Defaults
 

CHANGELOG.md

@@ -4,6 +4,9 @@ summary: Timeline of guardrail helper changes mirrored from Sweetistics and rela
 
 # Changelog
 
+## 2026-05-20 — OpenClaw Deployment Account
+- Added AGENTS routing to require `service@openclaw.org` accounts for OpenClaw deployments.
+
 ## 2026-05-20 — Reminders Skill
 - Added `reminders` skill for Apple Reminders CRUD through the `rem` CLI with JSON/read-back verification and macOS permission notes.