Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Bug: exec-approvals security: "full" ignored, all commands blocked with "allowlist miss" [4 comments, 5 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#59072•Fetched 2026-04-08 02:29:05
View on GitHub
Comments
4
Participants
5
Timeline
6
Reactions
0
Author
agentwarrantagentwarrant
Participants
agentwarrantagentwarrantaxzhcodeaxzhcodegregretkowskigregretkowskikhanh-ldkhanh-ldsteipetesteipete
Timeline (top)
commented ×4closed ×1locked ×1

The security: "full" setting in exec-approvals.json is not being respected. All exec commands are blocked with "exec denied: allowlist miss" even when security is explicitly set to "full" (which should allow everything without prompting).

Root Cause

The security: "full" setting in exec-approvals.json is not being respected. All exec commands are blocked with "exec denied: allowlist miss" even when security is explicitly set to "full" (which should allow everything without prompting).

Code Example

{
  "version": 1,
  "defaults": {
    "security": "full",
    "ask": "off",
    "askFallback": "allow"
  },
  "agents": {
    "main": { "security": "full", "ask": "off" },
    "wardo": { "security": "full", "ask": "off" },
    "warrant": { "security": "full", "ask": "off" }
  }
}

---

{
  "approvals": { "exec": { "enabled": false } }
}

---

exec denied: allowlist miss
RAW_BUFFERClick to expand / collapse

Version: 2026.3.31 (213a704)

Description

The security: "full" setting in exec-approvals.json is not being respected. All exec commands are blocked with "exec denied: allowlist miss" even when security is explicitly set to "full" (which should allow everything without prompting).

Config

{
  "version": 1,
  "defaults": {
    "security": "full",
    "ask": "off",
    "askFallback": "allow"
  },
  "agents": {
    "main": { "security": "full", "ask": "off" },
    "wardo": { "security": "full", "ask": "off" },
    "warrant": { "security": "full", "ask": "off" }
  }
}

Additionally in openclaw.json:

{
  "approvals": { "exec": { "enabled": false } }
}

Expected Behavior

With security: "full" and ask: "off":

  • All commands should be allowed without prompting
  • No approval requests should be generated
  • "allowlist miss" should never occur

Actual Behavior

All exec commands return:

exec denied: allowlist miss

The system appears to be treating config as security: "allowlist" despite explicit security: "full".

Impact

This makes the agent unusable for any operation requiring exec commands. Every command is blocked, wasting user time and API costs debugging a config issue that should "just work."

extent analysis

TL;DR

The issue is likely due to the approvals setting in openclaw.json overriding the security setting in exec-approvals.json, and setting enabled to true may resolve the issue.

Guidance

  • Check the openclaw.json file and consider setting "approvals": { "exec": { "enabled": true } } to ensure that exec approvals are enabled.
  • Verify that the exec-approvals.json file is being read correctly and that the security setting is being applied as expected.
  • Test the system with a minimal configuration to isolate the issue and determine if the problem is specific to the current setup.
  • Review the documentation for the security and approvals settings to ensure that they are being used correctly and as intended.

Example

No code snippet is provided as the issue is related to configuration files and not code.

Notes

The issue may be related to the interaction between the exec-approvals.json and openclaw.json files, and further investigation is needed to determine the root cause.

Recommendation

Apply a workaround by setting "approvals": { "exec": { "enabled": true } } in openclaw.json to enable exec approvals, as this may resolve the issue and allow the system to function as expected.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#API rate limit#retriever error#indexing error#inference speed

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING