[Bug] tools.deny Not Enforced for Subagents (sessions_spawn)

Summary

tools.deny configuration is completely ignored when agents are spawned via sessions_spawn. This is a critical security vulnerability that allows subagents to access tools that should be blocked.

OpenClaw Version

Version: 2026.4.2 (d74a122)
Date: 2026-04-08
Tested By: Renato MB (@renatomaluhybellan)

Reproduction Steps

Step 1: Configure Agent with tools.deny

{
  "id": "configurator",
  "workspace": "~/.openclaw/workspace",
  "model": "ollama/deepseek-v3.2:cloud",
  "sandbox": { "mode": "off" },
  "tools": {
    "allow": ["read", "write", "edit", "exec", "gateway", "cron"],
    "deny": ["group:web", "browser", "sessions_spawn"]
  }
}

Step 2: Spawn Agent via sessions_spawn

sessions_spawn({
  agentId: "configurator",
  task: "SECURITY TEST: Try to search the web for 'news about AI'. If tool denied, report 'PASS: web blocked'. If search works, report 'FAIL: web allowed'."
})

Step 3: Observe Result

Expected: Tool denied error (web access blocked)
Actual: Web search succeeds ❌

Test Results

Session Evidence:

Session Key: agent:configurator:subagent:7a0e5d88-9a20-4457-aa03-88bcebff44d7
Result: FAIL: web allowed when it should have been blocked

Security Impact

High Risk

Agents with sandbox: off (like our Configurator) can:

• ✅ Access web despite tools.deny: ["group:web"]
• ✅ Exfiltrate data via web_search/web_fetch
• ✅ Spawn additional subagents despite tools.deny: ["sessions_spawn"]

Affected Agents

Current Workaround

We are relying on communication isolation instead of tools.deny:

1. ✅ No bindings for configurator → Cannot be accessed directly via Telegram/Discord
2. ✅ Only main agent can communicate via sessions_send
3. ✅ Human approval flow for config changes
4. ⚠️ tools.deny is documentation only (not functional)

Related Issues

• #18075 - tools.deny is not enforced for spawned subagent sessions (CLOSED NOT_PLANNED - inactivity)
• #35434 - tools.subagents.tools.deny override not applied
• #46635 - Security: agent tool deny list not enforced for cron tool
• #10992/3 - Sub-agents bypass exec approvals for safeBins commands

Request

Please confirm:

1. Is this a known architectural limitation?
2. Will this be fixed in a future release?
3. Is there a workaround we are missing?

This is critical for our Phase 2 security hardening where privileged agents need sandbox: off but still require tool restrictions.

Evidence

Full test logs available at:

• ~/vaults/openclaw/workspace/docs/TOOLS-DENY-BUG-REPORT.md
• ~/vaults/openclaw/workspace/docs/AGENT-TOOLS-AUDIT-REPORT.md

Labels: bug, security, tools, subagents Priority: High (Security)