openclaw - 💡(How to fix) Fix Feature request: allowedTools / toolPolicy param for sessions_spawn [1 comments, 1 participants]

Problem

When spawning sub-agents via sessions_spawn with runtime: "subagent", all tools available to the parent session are inherited by the child. There is currently no way to restrict which tools a sub-agent can use at the harness level — only soft prompt-level hints.

This creates two real failure modes:

1. Accidental channel writes — a worker agent calls message(action=send) and sends a message to a real user channel when it should only be editing files
2. Context bloat / confused workers — agents in tight loops try browser, web_search, or other irrelevant tools when the task only needs Read, Edit, and exec

Proposed Solution

Add an optional allowedTools (or toolPolicy) parameter to sessions_spawn:

sessions_spawn({
  task: "...",
  runtime: "subagent",
  allowedTools: ["Read", "Edit", "exec", "Write"]
})

The harness would enforce this at the session level — tools not in the list are simply unavailable to the child session, regardless of what the model tries to call.

Why Not Just Prompt Engineering?

Soft constraints work reasonably well but are not reliable for safety-critical boundaries (e.g., preventing a worker from messaging users). A prompt that says "do not use the message tool" can be ignored under pressure. Hard enforcement at the harness layer is the right place for this.

Prior Art / Pattern Reference

The concept maps to a ToolPermissionContext pattern — a scoped execution context where tool availability is determined at spawn time rather than inherited from the parent.

Use Case

We run a multi-agent system with ~10 agents. When spawning coding workers we want to restrict to file + exec tools only. When spawning research workers we allow web_search but not message. Currently we rely entirely on prompt instructions for this boundary.

Effort Estimate (from outside)

Likely involves filtering available tools in the session initialization path when a toolPolicy config is present. Low user-facing complexity, meaningful safety improvement.

Filed on behalf of the Pinnacle NW agent team. Happy to provide more context or examples.