{
  security.sudo.extraRules = [
    {
      users = [ "openclaw" ];
      commands = [
        {
          command = "/run/current-system/sw/bin/cat";
          options = [ "NOPASSWD" ];
        }
        {
          command = "/run/current-system/sw/bin/docker";
          options = [ "NOPASSWD" ];
        }
      ];
    }
  ];
}