Your agent is halfway through a task and suddenly stops. No error from the tool itself, just a vague denial: permission denied, blocked by policy, missing scope, not approved. The task dies and the session stalls. Here is the fastest way to identify the layer that denied the call and fix it without turning off safety.
Why does OpenClaw keep denying my tool calls?
OpenClaw checks every tool call against three independent layers: tool policy, exec approvals, and resource scopes. If any one layer says no, the call is denied, even when you already approved it somewhere else. The fix is almost never a global setting; it is identifying which layer rejected the call and adjusting that one layer.
Permission denials feel worse than other failures because the message is vague, but there are only a handful of layers that can deny a tool call. Once you know which layer did it, the fix is usually one config change.
What are the three layers that can deny a tool?
OpenClaw checks permissions in layers, and each layer denies independently. If any one of them says no, the call does not run. That is why you can approve something in one place and still get denied: a different layer is blocking.
- Tool policy. The global and per-agent tool config decides which tools exist and which security mode they run under. If a tool is denied here, no approval flow will save you. This is the layer controlled by
tools.exec.mode,tools.exec.security, and per-agent tool overrides. - Exec approvals. The host-level approval system for commands that run on your gateway or node. It uses a local approvals file (
~/.openclaw/exec-approvals.json) with its own security mode, ask policy, and per-agent allowlist. Commands run only when tool policy, approvals policy, and any prompt all agree. - Resource scopes. The narrowest layer: which files, paths, URLs, or command patterns a tool may touch. A tool can be fully allowed while a specific path or pattern is still denied. This is where most “it works for other files but not this one” bugs live.
When you hit a denial, your first job is to figure out which layer rejected the call. The error message usually hints at it: “blocked by policy” points at layer one, “not approved” or “approval required” points at layer two, and a specific path, scope, or pattern in the message points at layer three.
How do I find out which layer denied the call?
Do not guess. OpenClaw ships commands that show you the merged, effective permission state, including what config set it:
openclaw exec-policy showshows the local merged view of tool policy and approvals, with the effective result.openclaw approvals getshows requested policy, host policy sources, and what actually applies (add--gatewayor--node <id>to target a specific host).openclaw doctor --lintsurfaces config-level problems, including permission posture issues, in one pass.
Run these before changing anything. The whole point is to see which layer denied the call instead of randomly loosening settings until something works.
How do I fix “blocked by policy” or “tool denied”?
If the denial mentions policy or the tool itself, check tools.exec.mode (the preferred surface) or the legacy tools.exec.security. The modes are:
- deny – blocks all host exec requests.
- allowlist – runs only allowlisted commands without asking.
- ask – allowlist policy, but prompts on misses.
- auto – allowlist policy with an automatic reviewer on misses before falling back to a human.
- full – runs everything without prompts.
A very common trap: the default. Exec security defaults to full on gateway and node hosts, but a sandbox host defaults to deny. If your agent runs in a sandbox and suddenly cannot run commands, that default flip is usually why. Set the mode explicitly instead of relying on the default.
Fastest safe fix: use the built-in presets. openclaw exec-policy preset cautious sets host to gateway, security to allowlist, ask to on-miss, and askFallback to deny. That is a sane baseline: known commands run, unknown commands prompt, and nothing runs silently. Only reach for preset yolo (full, no prompts) if you fully understand the tradeoff, and never on a machine you do not trust.
How do I fix “approval required” or “not approved”?
If the agent is being told a command needs approval, the ask layer is doing its job. The question is whether the prompts can actually reach you, and whether the allowlist already covers the command.
The gotcha that bites most people: askFallback. When a prompt is required but no UI is reachable (headless setup, no companion app, prompt timeout), the fallback defaults to deny. Your agent gets denied not because the command is bad, but because the approval prompt had nowhere to go. If you run OpenClaw without a UI, set askFallback to allowlist so a missing prompt falls back to the allowlist instead of a blanket no.
Then build the allowlist. Allowlists are per agent, and patterns are globs. A bare name like rg matches only commands invoked through PATH. A path glob like ~/Projects/**/bin/tool trusts one specific binary location. You can also constrain arguments with argPattern, so python3 with argPattern: "^safe\\.py$" allows only that one script, not arbitrary Python. Start with the few commands your agent actually uses and expand as real needs show up.
Why is one file “permission denied” while others work?
This is the classic “works over here, denied over there” case. The tool is allowed, but the resource scope blocks the specific path. Check three things:
- Is the path inside the workspace? Filesystem tools are often scoped to the agent workspace. If the agent is trying to write somewhere else, that is a scope denial, not a tool denial. Move the file or grant the path explicitly.
- Does the sandbox allow that workspace access? Sandbox workspace access can be
none,ro, or read-write. A read-only agent hitting a write attempt gets exactly this error. - Does the permission profile match the job? OpenClaw supports pre-built permission profiles (for example a data-analyst style profile) plus per-agent overrides. If the profile is stricter than the task, you get runtime denials even after a successful setup. Check the profile, then override narrowly with the specific paths the agent needs.
The pattern to remember: match the tool to the resource, not the other way around. Grant the exact paths and patterns the task needs, and no more.
What does “missing scope” mean for a skill?
Skills declare the permissions they need. If you see a “missing scope” error, for example operator.read, two things can be wrong. First, the skill’s requiredPermissions may not be granted. Second, and sneakier: your policy can be stricter than the skill needs, which produces a runtime denial even after the skill installs cleanly. Check the skill’s declared permissions, then check whether your permission profile is stricter. If it is, either loosen the profile for that skill or grant the missing scope explicitly.
Why did my approval work once and then fail later?
A single approval covers a single command. “Allow once” is not “allow this pattern forever,” and “allow always” entries in the approval flow are the durable trust that survives restarts. If the agent re-runs the same command later and gets denied again, check whether the earlier approval was one-time only. This trips up automation constantly: a manual approval works in the moment, then the cron job gets denied at 3 a.m. because nothing was added to the allowlist.
Should I just approve everything to stop the denials?
Permission denials are annoying, but they are the guardrail. The “just approve everything” path is how agents end up running commands nobody reviewed, which is exactly the failure mode behind this year’s sandbox escape and rogue agent stories. The goal is not zero denials. The goal is that the denials that remain are the ones you actually want to see.
A realistic target: a cautious baseline (allowlist plus on-miss asking), a per-agent allowlist that covers the commands each agent actually uses, resource scopes limited to the paths that agent touches, and askFallback set to allowlist so headless runs degrade to the allowlist instead of a wall of denials. Most users who set this up report their agents stop dying mid-task while keeping a meaningful review point on anything new.
The 60-second denial checklist
Next time you see a denial, run through this in order:
- Run
openclaw exec-policy showto see the effective policy and which layer is strictest. - Is the message about the tool itself? Fix
tools.exec.modeorsecurity, or applypreset cautious. - Is it an approval miss? Check
askandaskFallback, then add the command to the per-agent allowlist. - Is it a specific path? Check workspace access, sandbox scope, and the permission profile.
- Is it a skill scope? Compare the skill’s
requiredPermissionswith your policy. - Restart the gateway after config changes so the new policy loads.
One more thing: after you change permission config, restart the gateway. Several presets and policy changes only take effect on a clean load, and a stale gateway will keep denying with the old rules while your new config sits unread.
Bottom line
Permission denials look mysterious, but they come from three layers: tool policy, exec approvals, and resource scopes. Identify the layer with exec-policy show, fix that layer specifically, and set a cautious baseline with a real allowlist instead of flipping everything to full. The agent gets to work, you keep a review point on anything new, and the 3 a.m. cron job stops dying.
If your denials come with token burn on top, our token cost guide covers capping usage and spotting runaway sessions. And if the agent is stuck in a loop retrying denied calls, the loop fix guide shows how to stop it in minutes.
Still getting denied after the checklist?
Permission errors and runaway sessions often travel together. The loop guide shows how to stop an agent that keeps retrying denied calls, and the token cost guide keeps the bill in check while you sort out policy.
About The Author
