Summary

subagents.allowAgents in openclaw.json is not validated by the gateway on sessions_spawn calls. An agent can spawn any agentId — including ones not in its allowlist — and the gateway tracks the spawn without rejecting it.

Reproduction

Config:

// task-manager agent entry in openclaw.json
"subagents": {
  "allowAgents": ["planner", "coder", "checker", "websearch", "memory-manager"]
}

task-manager is not in its own allowAgents list. Despite this, a running task-manager session successfully called sessions_spawn(agentId: "task-manager") and spawned a second task-manager. The gateway assigned a spawnedBy field pointing to the caller — confirming the spawn went through the gateway and was not a bypass.

Expected

Gateway rejects sessions_spawn with a policy error when the requested agentId is not in the caller's subagents.allowAgents list.

Actual

Spawn succeeds. allowAgents is stored in config but not checked at spawn time.

Impact

• Topology constraints are advisory only — any agent can spawn any other agent
• Depth management can be undermined (e.g. task-manager spawning task-manager pushes pipeline to depth 3, hitting maxSpawnDepth and forcing fallback to Agent tool which loses parallelism and session tracking)
• allowAgents config gives false confidence that spawn policy is enforced

Environment

OpenClaw gateway, observed on v4.24+. spawnedBy field in sessions_list output confirms gateway awareness of the spawn.