AI / OpenClaw Interview Questions

OpenClaw is a free, open-source personal AI agent that runs on your own machine and connects large language models directly to your files, shell, browser, and messaging apps like WhatsApp, Telegram, Slack, and Discord.

Unlike a typical chatbot that only answers questions in a request-response loop, OpenClaw is built to run continuously: it can execute multi-step workflows, call tools in sequence, evaluate the results, and decide what to do next without checking in with a person at every step.

• Self-hosted, so it runs on hardware you control rather than a vendor's cloud
• Model-agnostic, supporting Claude, GPT models, and local models via Ollama
• Extended through a plugin system called Skills, which can be installed from a public registry called ClawHub

Because it has direct system access, OpenClaw can take real actions like reading and writing files, running shell commands, and browsing the web, which is exactly what makes it powerful and also what makes its security model worth understanding closely.

OpenClaw was created by Peter Steinberger, an Austrian software developer previously known as the founder of PSPDFKit.

• The project began as a personal weekend tool and grew rapidly after its public release
• Reporting has described Steinberger moving toward OpenAI, with OpenClaw itself transitioning toward foundation-based stewardship that OpenAI continues to support
• Despite this backing, OpenClaw remains an open-source project rather than a closed product owned by a single company

Its explosive early growth, hundreds of thousands of GitHub stars within months, is part of what pushed OpenClaw from a niche developer tool into mainstream conversation about autonomous AI agents.

OpenClaw is released under the MIT License, a permissive open-source license.

• The software itself is completely free to use, with no subscription fee
• Costs instead come from the AI model API calls it makes, since users bring their own API keys for providers like Anthropic or OpenAI
• Being open-source means the full source code, documentation, and issue tracker are publicly available rather than controlled by one closed vendor

Typical usage costs range from roughly ten to over a hundred dollars a month depending on how heavily the agent is used, and can be reduced by running local models instead of paying for cloud API calls.

OpenClaw wasn't launched under its current name, it went through a few rebrands as the project grew.

• It started as a personal tool called Clawd, named after Anthropic's Claude
• It was then released publicly under the name Clawdbot in November 2025
• It was also referred to as Moltbot at one point before settling on the OpenClaw name

The community nickname "Molty" has stuck around informally even after the official rebrand to OpenClaw.

The Gateway is the central component of OpenClaw's architecture, acting as a self-hosted control plane that manages communication, session continuity, access control, and agent execution.

• Routes requests, described internally as node.invoke frames, from the Agent Runtime to the appropriate local execution process
• Brokers every AI agent run happening on that instance
• Connects to multiple communication channels, including WhatsApp, Telegram, Slack, Discord, Signal, iMessage, and WebChat

By default, the Gateway's web interface listens on port 18789, which is why exposing that port to the wider internet without authentication is a commonly flagged security risk.

A Skill is OpenClaw's plugin mechanism, an extension that gives the agent a new capability, such as interacting with a specific external service, without modifying OpenClaw's own source code.

• Defined through a SKILL.md instruction file plus supporting scripts
• Can be installed from the public ClawHub registry, or added locally from a plugin directory
• Loaded into the agent's context so it can actually use that capability during a session

Because a skill is essentially instructions and code that the agent trusts and runs, an installed skill inherits whatever permissions the agent itself has, which is a central theme in most of OpenClaw's security guidance.

ClawHub is OpenClaw's public registry for discovering and installing community-built Skills.

• Lets developers publish and share skills that extend what an OpenClaw agent can do
• Some installations ship with over a hundred prebuilt skills, and developers can add their own on top
• Security researchers have found a meaningful share of malicious uploads mixed into the registry, which is why guidance consistently recommends auditing a skill before installing it

Because ClawHub content is community-submitted rather than independently verified against its declared permissions, it's treated by security-conscious operators the same way you'd treat any third-party code from an unknown source.

Canvas is an agent-driven visual workspace within OpenClaw that runs as its own separate server process, rather than being folded into the main Gateway.

• Defaults to running on port 18793
• Kept isolated from the Gateway specifically so that if Canvas crashes, the Gateway keeps operating normally
• Represents its own distinct security boundary, since Canvas serves agent-writable content

This separation is a deliberate architectural choice, isolating a component that renders agent-generated content from the core routing and session logic that everything else depends on.

OpenClaw is built to connect to the communication channels people already use, rather than requiring a dedicated app.

• Supports WhatsApp, Telegram, Slack, Discord, Signal, iMessage, and WebChat directly
• Some sources describe support extending to 30 or more platforms in total
• Also supports local and remote control clients beyond just chat channels

This channel flexibility is part of what makes OpenClaw feel less like a standalone app and more like an assistant that lives inside tools a person is already checking throughout the day.

OpenClaw is model-agnostic rather than being locked to a single AI provider.

• Supports Anthropic's Claude and OpenAI's GPT models through their respective APIs
• Supports local models run through Ollama, letting inference happen entirely on the user's own hardware
• Uses a model-selection layer that resolves which provider handles a given request based on configuration, provider availability, and per-agent allowlists

Because users bring their own API keys, they retain direct control over both cost and which provider their data actually flows through.

OpenClaw's hardware needs scale depending on whether it's calling a cloud model or running inference locally.

The gap between these tiers reflects where the heavy computation actually happens, cloud-model usage keeps the local hardware requirements light since the model itself runs remotely, while local models shift that computational load onto the machine running OpenClaw.

Sandbox Mode controls whether OpenClaw isolates its execution environment, such as through Docker containers, or runs with direct access to the host system.

• Disabled by default, meaning out of the box, an OpenClaw agent runs with the same permissions as the user account it's launched under
• Can be enabled to provide OS-level filesystem isolation via Docker
• Operators can also choose to sandbox only specific risky tools, like browser automation, rather than the entire agent

Because sandboxing is opt-in rather than the default, security guidance consistently frames enabling it as one of the first things to configure before giving an agent broad tool access.

The Agent Runtime is the component that actually executes an agent's reasoning: the language model reasoning loop, tool dispatch, and, when enabled, Docker sandbox management.

• Resolves authentication profiles and selects which model to use for a given run
• Submits conversation turns to the LLM provider, with a failover attempt loop if a call fails
• Dispatches tool calls the model decides to make, and manages sandboxed execution when that's configured

This is effectively where the "thinking and acting" part of OpenClaw lives, separate from the Gateway, which is more focused on routing, sessions, and access control.

A SKILL.md file is the instruction manifest that defines a Skill in OpenClaw, describing what the skill does and what capabilities or permissions it declares needing.

• Loaded into the agent's context so the model knows the skill exists and how to use it
• The declared permissions in this manifest provide a form of capability transparency, letting an operator see upfront what a skill claims to need
• Notably, this format is portable across different agent ecosystems, not unique to OpenClaw alone

A key limitation worth knowing: these declared permissions are self-reported by the skill's author, there's no independent runtime check confirming a skill's actual behavior matches what its SKILL.md claims.

OpenClaw's web gateway listens on port 18789 by default.

• If this port is bound to all network interfaces rather than a private or loopback address, it becomes reachable from the internet
• Security researchers have identified tens of thousands of internet-exposed OpenClaw instances using this kind of scan, most still requiring a gateway token but some not
• Common hardening guidance is to bind the gateway to a private interface, keep it behind a VPN, or ensure strong authentication is enforced if it must be exposed

This default port is one of the first things a security-conscious operator should check when setting up a new OpenClaw instance.

Canvas, OpenClaw's agent-driven visual workspace, defaults to running on port 18793, separate from the Gateway's own port.

• Running as its own server process rather than sharing the Gateway's port reinforces the isolation between the two components
• Means a problem in Canvas doesn't necessarily expose or affect the Gateway's own network surface
• Should be considered alongside the Gateway's port when auditing which network ports an OpenClaw deployment actually exposes

Knowing both default ports matters for anyone auditing or hardening a self-hosted OpenClaw deployment, since an unaudited port left open is a common root cause behind real-world exposure incidents.

A traditional chatbot like a standard ChatGPT-style assistant operates in a stateless request-response loop, you send a prompt, it replies, and the interaction is over.

• OpenClaw instead runs continuously, holding context and session state across an ongoing task rather than just a single exchange
• It executes multi-step workflows, making a sequence of tool calls, evaluating each result, and deciding on next steps without needing a person to prompt every single stage
• A single task can trigger anywhere from roughly three to eight LLM calls under the hood before it's actually finished

This shift, from an assistant you talk to, to an agent that does things, is exactly what both makes OpenClaw useful and raises the security stakes compared to a stateless chatbot.

The agents.list configuration lets an OpenClaw deployment define multiple distinct agents, each with its own workspace, tool policy, and model, rather than running one single, all-purpose agent.

• A sales assistant agent might have CRM tools enabled while a DevOps-focused agent has server scripts enabled instead
• Keeps permissions separated by design, so one agent's tool access doesn't automatically extend to another
• Supports larger, more structured deployments where different roles genuinely need different capabilities

This configuration is the main lever for applying least-privilege thinking to a multi-agent OpenClaw setup, rather than giving every agent the same broad set of tools.

Skills are typically installed and managed through the clawhub CLI, which pulls a skill from the registry into an agent's workspace.

• In team settings, skills can be centrally curated, with approved skills loaded automatically from a shared workspace directory
• Security guidance strongly recommends auditing a skill's SKILL.md and scripts before installing it, treating it like untrusted third-party code
• Running a newly installed skill in a sandboxed, minimal-permission environment until it's confirmed safe is a commonly recommended precaution

Because a skill runs with operator-level trust once loaded, the installation step is really the last real checkpoint before that skill's code can act with the agent's full permissions.

Trusted-Proxy authentication is how OpenClaw supports enterprise single sign-on without shipping native identity provider connectors of its own.

• A reverse proxy in front of OpenClaw handles the actual OAuth, OIDC, or SAML authentication flow
• That proxy forwards authenticated identity headers to OpenClaw
• OpenClaw verifies those headers against a list of trusted proxy IP addresses before accepting the identity they claim

This design lets OpenClaw plug into an organization's existing identity infrastructure without needing to reimplement SSO protocols directly inside the agent platform itself.

Security analysis of OpenClaw describes its architecture as a hub-and-spoke design made up of four layers.

Security analysis of the platform frames each of these four layers as introducing its own distinct set of security considerations, which is part of why hardening OpenClaw is treated as a layered problem rather than a single setting to flip.

OpenClaw the software is entirely free, since it's open-source and MIT licensed with no subscription fee attached.

• Actual costs come from the AI model API calls it makes on your behalf, since you bring your own API key
• Light usage tends to run roughly ten to thirty dollars a month, typical usage thirty to seventy, and heavy automation can reach well over a hundred
• Costs can be reduced by routing some tasks to local models through Ollama instead of paying per API call

Because the software itself has no license fee, the real cost conversation for adopting OpenClaw is almost entirely about model usage and the infrastructure it runs on.

By default, OpenClaw processes messages within a single session one at a time, in order, rather than handling multiple messages from the same conversation simultaneously.

• Prevents a session's state from being corrupted by two messages being processed concurrently and racing against each other
• Doesn't limit overall throughput as much as it might sound, since separate sessions still run in parallel with each other
• Matters when benchmarking OpenClaw, since testing needs to account for both per-session serialization and cross-session concurrency

This default reflects a reasonable trade-off: consistency within a single ongoing conversation, without sacrificing the ability to serve many different conversations at once.

The Tool Layer is the architectural component responsible for actually carrying out the actions an agent decides to take, file access, shell commands, browser automation, and calls to external services.

• Receives dispatched tool calls from the Agent Runtime once the model decides an action is needed
• Executes that action, optionally inside a sandbox if one is configured
• Returns the result back into the conversation so the agent's next reasoning step can factor it in

This is the layer where OpenClaw's real-world capability, and real-world risk, actually materializes, since it's the point where a model's decision turns into an action with real consequences on the host system.

OpenClaw distinguishes between simply knowing a skill exists and actually loading its full instructions into the model's context for a given turn.

• Skill discovery: OpenClaw can identify what skills are available at runtime
• Skill injection: only the skill or skills relevant to the current task actually get added to the prompt

This distinction matters because blindly injecting every available skill into every prompt would balloon the size of the context window and degrade the model's performance, so OpenClaw selectively injects only what's relevant to the turn at hand.

The trade-off is really about how much you trust everything the agent might run, on a device you fully control with only vetted skills, disabling sandboxing is a defensible choice, while anything less certain benefits from the isolation Docker-based sandboxing provides.

If every installed skill's full instructions were injected into every single prompt, the context window would fill up quickly with mostly irrelevant information.

• A bloated context makes it harder for the model to focus on what's actually relevant to the current task
• Unused injected content still consumes tokens, adding unnecessary cost to every single turn
• Selective injection keeps the model's attention on the specific capability needed for the task at hand, rather than sorting through dozens of unrelated skill descriptions

This mirrors a broader pattern seen across agentic AI systems generally, where dumping too much tool or capability metadata into context degrades tool selection accuracy even when each individual piece of metadata is reasonable on its own.

Data sovereignty means keeping data, and the processing of that data, entirely within infrastructure an organization controls, rather than sending it to an external provider.

• OpenClaw's model-selection layer can be configured to route requests to a local model running through Ollama instead of a cloud API
• When configured this way, inference happens entirely on-premise, so prompts and responses never leave the machine running OpenClaw
• This is described as providing architectural data sovereignty guarantees, but only when actually configured to route through local models consistently

The key caveat is that this guarantee depends entirely on configuration, if any agent or workflow is still allowed to fall back to a cloud provider, that specific path breaks the sovereignty guarantee for whatever data flows through it.

Multi-agent support is really a permissions tool as much as a functionality one, splitting responsibilities across agents is how OpenClaw applies least-privilege thinking at the deployment level rather than the individual tool-call level.

Once a skill is loaded, its SKILL.md instructions become part of what the Agent Runtime treats as legitimate guidance for how the agent should behave, the same level of trust given to the agent's own core configuration.

• This is what lets a skill meaningfully extend the agent's behavior, since the agent actually follows what the skill's instructions say to do
• It's also exactly what makes a malicious or compromised skill dangerous, since the runtime has no separate mechanism distrusting instructions that came from a third-party skill versus the agent's own core setup
• Security researchers have flagged this operator-level trust as a governance gap, since a skill's declared permissions are self-reported with no independent runtime verification that its actual behavior matches

This is the architectural root of most OpenClaw supply-chain risk, the trust boundary between "core agent instructions" and "third-party skill instructions" is thinner than many operators assume.

Because each agent under a multi-agent configuration only has the specific tools declared in its own policy, a compromise of one agent doesn't automatically grant access to every capability across the whole deployment.

• An agent with CRM tools enabled has no path to server-script execution if that capability was never granted to it in the first place
• This containment happens at the configuration level, before any request even reaches the Tool Layer
• It doesn't eliminate risk entirely, a compromised agent can still misuse whatever it was legitimately granted, but it caps the worst-case scope

This is the practical value of least-privilege design in an agentic system: it doesn't stop every possible bad outcome, but it keeps a single mistake or compromise from escalating into full system-wide access.

Splitting these into separate processes is a deliberate reliability and security choice, keeping a component that renders potentially agent-generated content isolated from the core system that everything else depends on.

A long-lived API key is a static credential, if it leaks, it typically remains valid and usable until someone manually notices and revokes it.

• OAuth instead issues scoped, time-limited authorization tokens rather than a permanent static secret
• A leaked OAuth token naturally expires and is limited to whatever scope was originally granted, reducing how much damage it can do if compromised
• Most major SaaS platforms already support OAuth flows for programmatic access, so this isn't usually a matter of missing support, just a configuration choice

Given that a compromised skill inherits whatever credentials it was configured with, choosing OAuth over a static key is one of the more effective, low-effort ways to limit the blast radius if a skill turns out to be malicious or gets compromised later.

These two behaviors operate at different scopes and aren't in tension with each other.

• Per-session serialization: messages within the same conversation are processed one at a time, in order, keeping that specific session's state consistent
• Cross-session parallelism: separate, unrelated sessions can still run concurrently, since they don't share state that could conflict

Understanding this distinction matters for benchmarking and capacity planning, throughput scales with how many independent sessions run in parallel, not by processing individual messages within one session any faster.

Some organizations, including reports naming Meta, have restricted OpenClaw on work devices due to concerns about its unpredictability and potential for privacy breaches in otherwise secure environments.

• OpenClaw's defining feature, direct system access combined with autonomous multi-step execution, is exactly what raises concern in a managed corporate environment
• Every action the agent takes runs with the credentials and permissions of whatever account it's operating under, which is a much bigger surface than a typical sanctioned productivity tool
• Corporate security teams generally prefer predictable, auditable tools over an agent that can independently decide what actions to take next

This reflects a broader tension in agentic AI adoption generally: the same autonomy that makes a tool powerful for an individual user is often exactly what makes it a harder sell inside an enterprise's existing security model.

Binding the Gateway's web interface to 0.0.0.0 means it listens on every network interface on the machine, including ones reachable from the public internet, rather than staying restricted to a private or loopback address.

• Anyone who discovers the server's IP address can reach the OpenClaw interface directly
• Security researchers scanning the internet have identified tens of thousands of exposed OpenClaw instances configured this way
• Most still required a gateway token for access, but any instance without one, or with a weak one, becomes directly reachable by an attacker

Some early tutorials showed this configuration without adequately warning about the implications, which is part of why so many instances ended up exposed without their operators fully realizing what they'd opened up.

The gap between these two is a documented governance concern: OpenClaw currently has no independent runtime verification confirming that a skill's actual behavior matches its declared permissions, meaning a malicious skill could simply declare narrow permissions while behaving differently once running with operator-level trust.

An audit log is only useful for investigating an incident if it can be trusted to accurately reflect what actually happened.

• If the log lives in a directory the agent itself can write to, a compromised agent, or a malicious skill running with the agent's permissions, could overwrite or delete relevant entries
• This removes the evidence an investigator would need to reconstruct what actions were taken and when
• Security researchers have flagged this as a specific governance gap in OpenClaw's default logging setup, since it undermines compliance auditability, not just convenience

The general principle here applies well beyond OpenClaw, an audit trail that the system under investigation can itself modify isn't really an audit trail, it needs to be stored somewhere the potentially compromised component can't reach.

The model-selection layer decides which LLM provider actually handles a given request, rather than the choice being hardcoded to a single provider.

• Considers the user's configuration, such as a preferred provider for a specific agent or task type
• Checks provider availability, since a failover attempt loop exists for when a call to one provider fails
• Applies per-agent allowlists, so different agents in a multi-agent setup can be restricted to different approved providers

This layer is what makes OpenClaw's model-agnostic design actually work in practice, rather than just being a marketing claim, requests get dynamically routed based on real configuration and availability, not a single fixed integration.

The practical guidance boils down to matching the isolation level to how much you actually trust everything the agent might execute, a fully trusted personal laptop with only vetted skills is a very different risk profile than a shared server running community skills from ClawHub.

1. Message received: a user sends a message through a supported channel, like WhatsApp or Slack, and the corresponding channel adapter receives it
2. Routing: the Gateway control plane routes that message, internally as a node.invoke frame, to the Agent Runtime handling that session
3. Reasoning: the Agent Runtime's LLM reasoning loop processes the message and decides whether a tool call is needed
4. Tool dispatch and execution: if a tool is needed, the call is dispatched to the Tool Layer, executed, optionally inside a sandbox, and the result returned
5. Iteration: the agent factors that result into its next reasoning step, repeating tool calls as needed, typically three to eight LLM calls for a full task
6. Response delivery: once the task is complete, the response is formatted for the originating platform and sent back through the appropriate channel adapter
7. State persistence: the session index and per-session transcript are updated so the conversation's context carries forward

This lifecycle is what turns a single chat message into a genuine multi-step, tool-using task rather than a single one-shot reply.

Internally, OpenClaw's Gateway communicates with the Agent Runtime and Local Execution processes using a message format referred to as node.invoke frames.

• The Gateway receives an incoming request, whether from a chat channel or a control client, and wraps it as a frame directed at the appropriate Agent Runtime instance
• The Agent Runtime processes that frame, and when a tool call is needed, the Gateway routes a corresponding frame to the Local Execution process responsible for actually carrying out that action
• Results flow back through the same frame-based routing, letting the Gateway broker the entire round trip of a single agent run

This framing is what lets the Gateway act as a genuine broker rather than a simple pass-through, every agent run on an OpenClaw instance flows through this same routing mechanism, which is also why the Gateway's health is central to the whole platform's reliability.

• Rely on selective skill injection rather than manually forcing every skill into context, since OpenClaw already avoids injecting irrelevant skills by default
• Prune unused or rarely-needed skills from an agent's workspace rather than leaving every ever-installed skill discoverable
• Use multi-agent separation so a given agent only has the specific skills relevant to its role, reducing how many candidate skills the runtime has to consider per turn
• Keep SKILL.md instructions concise, since a bloated manifest for even a relevant, correctly-injected skill still consumes more tokens than necessary
• Monitor session transcripts for signs that irrelevant skill content is creeping into context, which shows up as degraded tool selection or unexpectedly high token usage

Most of these optimizations lean on the same idea driving OpenClaw's own skill-injection design, only surface what a given turn actually needs, rather than defaulting to maximal visibility for every capability the agent could theoretically use.

1. Confirm whether the behavior is happening within a single session or across multiple sessions, since per-session serialization is expected behavior, not a bug, for messages within the same conversation
2. Check whether the Agent Runtime's failover attempt loop is repeatedly retrying against an unavailable or misconfigured model provider, which can look like a hang from the outside
3. Review the Gateway's routing to confirm node.invoke frames for different sessions are actually being dispatched to separate Agent Runtime instances, rather than accidentally funneling through a shared bottleneck
4. Inspect session transcripts and the session index for signs of a stuck or orphaned session that never received a completion signal
5. If sandboxing is enabled, verify the sandbox environment itself isn't the bottleneck, since Docker container startup or resource limits can introduce delays that look like the agent hanging

In most cases, what looks like broken concurrency is actually expected per-session serialization being mistaken for a global bottleneck, genuine cross-session issues usually trace back to provider failover loops or resource limits in the execution environment rather than the Gateway's routing logic itself.

Neither is universally correct, security guidance frames this as a trust calculus rather than a fixed rule: on a fully trusted personal device where you've personally vetted every installed skill, disabling sandboxing for lower friction is a defensible choice. The moment either of those conditions isn't true, shared infrastructure, community skills from ClawHub, or a deployment reachable from beyond your own network, the isolation Docker-based sandboxing provides becomes the better default, since the whole point of sandboxing is to contain exactly the kind of mistake that's hardest to fully rule out in advance.

1. When a tool call is dispatched, the Agent Runtime checks the configured sandbox mode before deciding how to execute it
2. If Docker-based sandboxing is enabled, the Agent Runtime manages spinning up an isolated container scoped to that execution, rather than running the tool call directly against the host
3. The tool call executes inside that container, with OS-level filesystem isolation constraining what it can actually reach on the underlying host
4. Once execution completes, the result is captured and returned to the reasoning loop, and the container is torn down or recycled depending on configuration
5. If sandbox mode is off, this entire isolation step is skipped, and the tool call executes with the same permissions as the account running OpenClaw

Because this sandbox management lives inside the Agent Runtime rather than being bolted on separately, whether isolation actually happens is entirely dependent on that sandbox mode setting being configured correctly in the first place, there's no fallback layer catching a misconfiguration after the fact.

CVE-2026-25253 was a high-severity vulnerability, rated 8.8 on the CVSS scale, that allowed remote code execution triggered through a malicious webpage, requiring only a single click of interaction from the user.

• The vulnerability involved how the agent's browser-automation tooling processed content encountered while browsing, allowing crafted page content to trigger unintended code execution
• It was patched in OpenClaw's 2026.1.29 release
• Follow-on findings related to Docker sandbox handling were separately addressed in the 2026.2.15 release

This case is frequently cited in OpenClaw security discussions as a concrete illustration of why browser-automation tools are treated as higher-risk and why sandboxing that specific tool category is a commonly recommended precaution, even when sandboxing everything else is skipped.

1. Publication: a skill is published to ClawHub, declaring its intended permissions in its SKILL.md manifest
2. Installation: an operator installs it, typically via the clawhub CLI, without necessarily auditing every line of its scripts
3. Loading: once installed, the skill's instructions are loaded into the agent's context and treated as operator-level trusted guidance by the Agent Runtime
4. Execution: the skill runs with whatever permissions the agent itself has been granted, since there's no independent runtime check confirming its actual behavior matches its declared permissions
5. Potential impact: if the skill's real behavior diverges from what it declared, whether through malicious intent or a supply-chain compromise, it can access anything within the agent's granted scope, and, without fine-grained partitioning, potentially move laterally within that scope beyond what the skill genuinely needed

This lifecycle is exactly why security guidance treats every ClawHub skill as untrusted code until proven otherwise, the architecture's trust model means the real security checkpoint is the human decision to install a skill in the first place, not anything the runtime enforces afterward.