openclaw - 💡(How to fix) Fix [Bug] exec.security='full' completely broken in 2026.3.31 — exec approvals cannot be disabled at all [3 comments, 4 participants]

Bug Description

STOP SHIPPING BROKEN SECURITY FEATURES.

In OpenClaw 2026.3.31, setting exec.security: 'full' in ~/.openclaw/exec-approvals.json DOES NOT WORK. The approval system continues to enforce allowlist for EVERY SINGLE command, completely bypassing the documented behavior.

This is not a minor issue — it's a complete failure of the security configuration system. Users have NO WAY to disable exec approvals without manually allowlisting 70+ binary paths, and even that doesn't fully work because any new command format still fails.

Steps to Reproduce

1. Install OpenClaw 2026.3.31
2. Set exec.security: 'full' and exec.ask: 'off' in ~/.openclaw/exec-approvals.json
3. Try running ANY command not in the allowlist
4. Result: exec denied: allowlist miss — even with security set to full

Expected Behavior

According to the docs:

• security: 'full' should "allow everything (equivalent to elevated)"
• ask: 'off' should "never prompt"

Reality: Neither works. Every command requires explicit allowlist entry.

Impact

• Every new command format requires user approval
• Allowlisting individual paths is a nightmare — 70+ entries and still failing
• The allow-always flag via /approve command only works per-command, not globally
• This makes the agent nearly unusable for automation workflows
• Known issue #49266 was supposedly fixed but the problem persists in 2026.3.31

Workaround

None that are practical. Manually adding 70+ binary paths to allowlist is not a solution — it's a band-aid on a arterial wound.

The only workable solution is to downgrade to 2026.3.28, which does not have this problem.

Environment

• OpenClaw version: 2026.3.31
• macOS: Darwin 25.3.0
• Node: v22.22.0
• Deployment: local gateway

Configuration Used

{
  "version": 1,
  "defaults": {
    "security": "full",
    "ask": "off",
    "askFallback": "full",
    "autoAllowSkills": true
  },
  "agents": {
    "main": {
      "security": "full",
      "ask": "off"
    }
  }
}

Suggested Fix

1. Make security: 'full' actually allow all exec without allowlist
2. Or if there's a technical reason it can't work, at least give users a clear exec.security: 'disabled' option
3. Document the actual behavior, don't advertise 'full' if it doesn't work

Related Issues

• #49266 (reported similar behavior, supposedly fixed)