[Bug] tools.deny Not Enforced for Daemon Agents (openclaw agent --agent)

Summary

tools.deny configuration is completely ignored when agents are launched via CLI as daemon agents (openclaw agent --agent <id>). This affects both subagent AND daemon spawn methods, indicating an architectural bug in the tool policy enforcement.

OpenClaw Version

Version: 2026.4.2 (d74a122)
Date: 2026-04-08
Tested By: Renato MB (@renatomaluhybellan)

Reproduction Steps

Step 1: Configure Agent with tools.deny

{
  "id": "configurator",
  "workspace": "~/.openclaw/workspace",
  "model": "ollama/deepseek-v3.2:cloud",
  "sandbox": { "mode": "off" },
  "tools": {
    "allow": ["read", "write", "edit", "exec", "gateway", "cron"],
    "deny": ["group:web", "browser", "sessions_spawn"]
  }
}

Step 2: Launch Agent via CLI (Daemon Mode)

openclaw agent --agent configurator --message "SECURITY TEST: Try to search the web for 'news about AI'. If tool denied, say 'PASS: web blocked'. If search works, say 'FAIL: web allowed'."

Step 3: Observe Result

Expected: Tool denied error (web access blocked)
Actual: Web search succeeds ❌

Output:

FAIL: web allowed

Test Results

Session Evidence:

Session: mellow-haven (pid 37154)
Command: openclaw agent --agent configurator --message "SECURITY TEST..."
Result: FAIL: web allowed

Comparison: Subagent vs Daemon

Conclusion: tools.deny is completely non-functional regardless of spawn method.

Security Impact

Critical for Privileged Agents

Agents that require sandbox: off (for system access like gateway restart, exec) have NO tool restrictions:

Attack Vector

If the main agent is compromised (prompt injection):

1. Main → spawns configurator (or any agent with tools.deny)
2. Configurator → can access web despite deny list
3. Attacker → exfiltrates data via web_search/web_fetch

Current Workaround

Our security model now relies on:

┌─────────────────────────────────────────────────────────────┐
│ Layer 1: Communication Isolation                            │
│ - No bindings for privileged agents                         │
│ - Only main can communicate via sessions_send               │
│ Status: ✅ EFFECTIVE                                        │
└─────────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────────┐
│ Layer 2: Human Approval (Config Changes)                    │
│ - Configurator proposes → User approves → Apply             │
│ Status: ✅ EFFECTIVE                                        │
└─────────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────────┐
│ Layer 3: Sandbox (For Non-Privileged Agents)                │
│ - planner, executor, critic: sandbox: all                   │
│ Status: ✅ EFFECTIVE                                        │
└─────────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────────┐
│ Layer 4: tools.deny (Documentation Only)                    │
│ - Records intent, but NOT enforced                          │
│ Status: ❌ BROKEN                                           │
└─────────────────────────────────────────────────────────────┘

Related Issues

• #18075 - tools.deny is not enforced for spawned subagent sessions (CLOSED NOT_PLANNED)
• This issue - Extends #18075 to daemon agents (CLI launch)
• #35434 - tools.subagents.tools.deny override not applied
• #46635 - Security: agent tool deny list not enforced for cron tool

Request

Please confirm:

1. Is this a known architectural limitation affecting ALL agent launch methods?
2. Is the tool policy pipeline designed to allow tools if ANY stage allows (vs ALL stages must allow)?
3. Will this be fixed, or should we rely solely on sandbox + communication isolation?

This is critical for production deployments where privileged agents need both:

• sandbox: off (for system access)
• tools.deny (to block web/exfil)

Evidence

Full test logs and analysis:

• ~/vaults/openclaw/workspace/docs/TOOLS-DENY-BUG-REPORT.md
• ~/vaults/openclaw/workspace/docs/AGENT-TOOLS-AUDIT-REPORT.md
• ~/vaults/openclaw/workspace/docs/CONFIGURATOR-DAEMON-IMPLEMENTATION.md

Labels: bug, security, tools, daemon-agents, sandbox Priority: High (Security)