7 replies

exec-approvals.json not enforcing approval prompts for gateway-hosted agents

✅Solved

Hi, I'm trying to configure exec approval so that my agent asks for confirmation before running any terminal command. I've set up exec-approvals.json with what I think is a strict config, but commands run immediately with no approval prompt appearing in Telegram.

My setup:
- OpenClaw running on macBook M4 (local)
- Agent: gaw (gateway-hosted, accessed via Telegram)

What I've configured:

~/.openclaw/openclaw.json:
json{
"approvals": {
"exec": { "enabled": true }
}
}

~/.openclaw/exec-approvals.json:
json{
"version": 1,
"defaults": {
"ask": "on-miss",
"security": "allowlist",
"askFallback": "deny"
},
"agents": {
"gaw": {
"ask": "always",
"askFallback": "deny",
"autoAllowSkills": false,
"security": "deny"
}
}
}

What I've tried:
- Restarted the gateway after every config change
- Tested with both echo hello (assumed allowlisted) and curl https://example.com (should not be allowlisted)
- Both executed immediately with no approval prompt in Telegram

What the logs show:
~/.openclaw/logs/gateway.log shows exec tool calls completing normally
Zero approval-related entries — no "approval requested", "approval granted", or "approval denied" anywhere

Agent's analysis:
After checking the logs, the agent concluded that exec-approvals.json may only apply to node host execution (macOS app, remote nodes), and that gateway-hosted agent exec calls go through a different code path that bypasses the approval system entirely.

My question:
Is this a known limitation for gateway-hosted agents? Is there a different config or approach to gate exec calls for agents running on the gateway host?

Solution

Not a known limitation: exec approvals apply to
host=gateway
host=gateway
exec too, not just nodes / the macOS companion app.

What’s happening in your case is almost certainly one of these (both would produce exactly what you’re seeing: “commands run immediately, no approval events”):

1) Your

exec

exec

is running on

host=sandbox

host=sandbox

(approvals don’t apply there)

Exec approvals are a guardrail for real-host execution (

host=gateway

host=gateway

host=node

host=node

). If your agent is sandboxed,

exec

exec

often defaults to

host=sandbox

host=sandbox

:

- Exec tool doc: https://docs.openclaw.ai/tools/exec
(“

host

host

defaults to

sandbox

sandbox

when sandbox runtime is active…”)

Quick check/fix (in the Telegram chat with that agent):
- Send

/exec

/exec

(with no args) and see what it reports for

host/security/ask

host/security/ask

.
- Force host exec:

\/exec host=gateway security=allowlist ask=always

\/exec host=gateway security=allowlist ask=always

Then try a harmless command again. If approvals are working, the exec should come back as approval-pending (not “completed”).

Jump to solution

FotC�

Friends of the Crustacean 🦞🤝•2w ago•

7 replies

angaroxx

exec-approvals.json not enforcing approval prompts for gateway-hosted agents

✅Solved

Solution

1) Your

exec

exec

is running on

host=sandbox

host=sandbox

(approvals don’t apply there)

Exec approvals are a guardrail for real-host execution (

host=gateway

host=gateway

host=node

host=node

). If your agent is sandboxed,

exec

exec

often defaults to

host=sandbox

host=sandbox

:

- Exec tool doc: https://docs.openclaw.ai/tools/exec
(“

host

host

defaults to

sandbox

sandbox

when sandbox runtime is active…”)

Quick check/fix (in the Telegram chat with that agent):
- Send

/exec

/exec

(with no args) and see what it reports for

host/security/ask

host/security/ask

.
- Force host exec:

\/exec host=gateway security=allowlist ask=always

\/exec host=gateway security=allowlist ask=always

Then try a harmless command again. If approvals are working, the exec should come back as approval-pending (not “completed”).

Jump to solution

exec-approvals.json not enforcing approval prompts for gateway-hosted agents

1) Your
`exec`
`exec`
is running on
`host=sandbox`
`host=sandbox`
(approvals don’t apply there)

exec-approvals.json not enforcing approval prompts for gateway-hosted agents

1) Your
`exec`
`exec`
is running on
`host=sandbox`
`host=sandbox`
(approvals don’t apply there)

Similar Threads

Similar Threads

Similar Threads

exec-approvals.json not enforcing approval prompts for gateway-hosted agents

1) Your execexec is running on host=sandboxhost=sandbox (approvals don’t apply there)

exec-approvals.json not enforcing approval prompts for gateway-hosted agents

1) Your execexec is running on host=sandboxhost=sandbox (approvals don’t apply there)

Similar Threads

Similar Threads

Similar Threads

1) Your
`exec`
`exec`
is running on
`host=sandbox`
`host=sandbox`
(approvals don’t apply there)

1) Your
`exec`
`exec`
is running on
`host=sandbox`
`host=sandbox`
(approvals don’t apply there)