When your OpenClaw agent suddenly stops on every exec call and waits for /approve, the natural instinct is to blame a bug, or to assume OpenClaw got stricter in a recent update. Neither is what actually happened. OpenClaw did not decide to distrust you overnight, and the approval prompt is not a malfunction.
The prompt is OpenClaw enforcing a policy it can already see. Exec approvals are decided from two policy layers, and the effective policy is the stricter of the two. When prompts appear while your config looks untouched, the tightening almost always came from the second layer, the host approvals file, or from a change in how exec routing resolved. This guide shows you how to read both layers and restore the behavior you actually want.
The Myth: OpenClaw Got Stricter (or the Prompt Is a Bug)
The misconception is easy to fall into, because the prompt usually shows up right after an update, a reinstall, or a new session. It looks like the tool changed its mind about you. But OpenClaw does not raise approvals by default. A healthy install with unset keys runs at security=full and ask=off, which is the no-approval baseline.
The prompt is not a sign that OpenClaw got stricter. It is a sign that one of the two policy layers resolved to something stricter than your baseline. Fixing it means finding which layer tightened, not blaming the update.
The Truth: Two Policy Layers, and the Stricter One Wins
Layer 1 is your config, the requested policy. Keys under tools.exec say what you want: security (deny, allowlist, or full), ask (off, on-miss, or always), and host (where commands run). Newer OpenClaw versions also offer tools.exec.mode (deny, allowlist, ask, auto, full) as the normalized surface; the legacy keys still work wherever mode is not set. When the keys are unset, the defaults are security=full and ask=off, which is the no-approval baseline. A sandbox host defaults to deny instead.
Layer 2 is the host approvals file, the enforced policy. Each execution host keeps a local JSON file, ~/.openclaw/exec-approvals.json on the gateway host (or the state directory), with defaults and per-agent overrides. On macOS this is the file behind Settings, Exec approvals in the companion app. Here is the part that surprises people: approvals can only tighten the config-derived policy, never loosen it. If the host file is stricter than your config, the host file wins, no matter what the config says.
Read the Effective Policy, Not Your Config
Your config is only half the picture. The command that matters shows the merged result:
user@host:~$ openclaw exec-policy show # Merged view: Config, Approvals file, and the Effective Policy columns. # A healthy no-prompt setup shows: security=full, ask=off.
If the effective policy already reads security=full and ask=off but you are still being prompted, skip to the routing check below. If the effective policy is stricter, compare the two layers to find which one tightened.
Querying individual config keys is still useful, but read the result carefully. On many setups the keys were never explicitly set:
That is not a malfunction. Unset keys mean the defaults are in effect. It also means your config is probably not where the change happened, which is why you should look at the host approvals file next:
This is the file in its resting state: version 1, empty defaults, no agents, so the host inherits the requested tool policy and everything runs free. The file only becomes a problem when it carries stricter values, like a defaults block with "security": "deny" and "ask": "always", or a per-agent override with "ask": "always" that an update migrated in. Compare what the file says against the Effective column of openclaw exec-policy show; the layer with the stricter value is your culprit.
The Three Triggers Behind a Surprise Prompt
Now that you know which layer tightened, here are the usual reasons it happened:
- An update or reinstall reset the host approvals file. Upgrades can rewrite
exec-approvals.jsondefaults or migrate per-agent overrides, and the stricter host policy then wins even when your config still saysfull/off. Re-apply your intended policy with the commands below. - No UI is reachable to answer the prompt. Approval prompts are resolved by the macOS app or the Control UI on the execution host. If the companion app is not running, the ask fallback applies, and its default is
deny. Commands that used to run, or at least ask, may now fail outright or pile up as pending approvals. - Exec started routing into a sandbox.
tools.exec.host=auto(the default) chooses where commands run: sandbox when one is active, otherwise the gateway. Sandbox sessions always require approvals and default todeny. Your settings did not change, but whatautoresolves to did. - Allowlist mode with a new command. In
allowlistoraskmode, a command that is not on the agent’s allowlist is a miss. The log lineSYSTEM_RUN_DENIED: allowlist missmeans exactly that. Approve it once and it is remembered, or add a pattern to the per-agent allowlist.
Tail the log while you trigger an exec call if you want the diagnosis in one line: openclaw logs --follow. SYSTEM_RUN_DENIED: approval required means a prompt is pending with no UI to answer it, and SYSTEM_RUN_DENIED: allowlist miss points at the allowlist. Each signature names the layer to fix.
The Fix: Restore the Behavior You Actually Want
The fastest route is the preset that aligns both layers at once:
Two notes on preset yolo. It is intentionally local-only, so it updates the gateway host you run it on; for a node host or a remote gateway, use openclaw approvals set --node <id> or --gateway with the same JSON shape. And if you edit the config keys by hand instead, remember the second layer: a host file with stricter ask or security overrides config, and an omitted askFallback defaults to deny.
A Safer Middle Ground (and Session-Only Overrides)
Running everything at full/off is convenient, but allowlist mode with ask=on-miss gives you oversight without the noise: known commands run free, and a new command prompts once, then is remembered on that agent’s allowlist. The one-command version is openclaw exec-policy preset cautious (host=gateway, security=allowlist, ask=on-miss, askFallback=deny).
Allowlists are per agent and match glob patterns: a bare name like rg matches commands found through PATH, while a path glob like ~/Projects/**/bin/rg trusts one specific binary. Shell chains such as echo ok && pwd need every segment to satisfy the rules. If you only need a quiet session, not a config change, /exec security=full ask=off applies to the current session, and /elevated full is the break-glass path that skips approvals when both layers resolve to full/off.
Quick Reference
# See the merged effective policy openclaw exec-policy show # Inspect the host approvals file state openclaw approvals get # No prompts (aligns config + host file) openclaw exec-policy preset yolo # Allowlist + ask on first use of a new command openclaw exec-policy preset cautious # Session only, no config change /exec security=full ask=off # Apply to a node host instead of the local one openclaw approvals set --node <id> --stdin < file.json
Restart the gateway after config edits so the service picks up the new policy: openclaw gateway restart.
Related Fixes
Approval prompts are one of several ways a gateway can feel broken after a change. If commands fail with a port conflict, see how to fix the EADDRINUSE another-instance error. For config that behaves differently between the CLI and the service, see CLI vs gateway config mismatches, and for a gateway that will not start at all, the local mode fix. New to OpenClaw? Start with The Complete OpenClaw Guide.
The takeaway: an approval prompt is not OpenClaw getting stricter. It is the stricter of two policy layers winning. Read the merged result with openclaw exec-policy show, find which layer tightened, and restore it with openclaw exec-policy preset yolo, or openclaw exec-policy preset cautious if you want allowlist oversight.
Not Ready to Self-Host? Try ClawTrust
Building agents locally is powerful, but managing infrastructure, security, and scaling takes effort. ClawTrust provides managed OpenClaw hosting: your agents run securely in the cloud with automatic scaling, no DevOps overhead, and 24/7 monitoring.
This post contains affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.
About The Author
