How to Use OpenClaw Elevated Commands
Run sandboxed exec commands on the host deliberately with /elevated levels, allowlists, and approval boundaries.
· Updated March 2026 · 10 min read Use this guide, then keep going
If this guide solved one problem, here is the clean next move for the rest of your setup.
Most operators land on one fix first. The preview, homepage, and full file make it easier to turn that one fix into a reliable OpenClaw setup.
Elevated commands are for the moments when a sandboxed OpenClaw agent needs to run real host commands. That is powerful, so I would treat it like a controlled bridge, not a default operating mode. The docs split the concern clearly: sandboxing controls where exec normally runs, elevated mode lets authorized senders break out to the configured host path, and approvals still decide whether a command should actually execute unless the level is full.
30-second answer
Use /elevated on, /elevated ask, /elevated full, or /elevated off to control the session. The on and ask forms run outside the sandbox while keeping configured approvals. The full form runs outside the sandbox and skips approvals. The off form returns exec to sandbox-confined execution. Inline directives can apply to one message, while directive-only messages persist the setting for the session.
Where it fits
This belongs in workflows where the sandbox is the right default but a specific task needs host state: checking a service, touching a local repo, inspecting a node, or running a deploy command that cannot run inside the sandbox. It does not replace tool policy, host selection policy, or exec approvals. It simply changes whether sandboxed exec can leave the sandbox when all gates allow it.
Docs-grounded facts
- Elevated mode only changes behavior when an agent is sandboxed.
- /elevated on and /elevated ask run outside the sandbox while keeping approvals.
- /elevated full skips approvals.
- /elevated off returns to sandbox-confined execution.
- Inline elevated directives apply only to that message.
- Elevated cannot override tool policy if exec is denied.
Set it up deliberately
First confirm elevated is enabled in config and that the sender is allowed. The docs describe global gates under tools.elevated, per-agent gates, and allowFrom lists by channel identity. Then choose the smallest usable level. For routine diagnostics, elevated on is safer than full because approval rules still apply. Reserve full for tightly trusted sessions where approval prompts would only add noise and the command surface is already constrained.
Use it safely
Keep elevated use narrow. Name the host, working directory, and command intent before running anything destructive. Remember that elevated does not turn auto host selection into a free cross-host override, and it does not make a denied exec tool available. If approvals prompt, preserve the exact command for the human. Do not summarize away chained operators, pipes, or inline scripts because those are exactly where risk hides.
Common mistakes
The most dangerous mistake is leaving a session elevated after the host-only task is done. Turn it off when you no longer need it. Another mistake is using elevated to work around a bad sandbox design instead of fixing the workflow. If every command needs elevated, the agent probably belongs in a different execution profile, or the task should be delegated to a trusted host runner with a tighter runbook.
Verification checklist
Check the current elevated level, run one harmless command that proves the expected host path, then run the actual command. Afterward, switch elevated off if it was only needed temporarily. For team workflows, record who may use elevated, which channels are allowed, and what kinds of commands require human approval even when the sender is trusted.
Playbook angle
The OpenClaw Playbook frames elevated mode as an exception path with receipts. It is there so agents can get real work done without pretending the sandbox has access it does not have. The win is not fewer guardrails; the win is knowing exactly when, why, and by whom the guardrail was opened.
Operator note
How to Use OpenClaw Elevated Commands works best when it is written into a small runbook instead of left as tribal knowledge. Record the intended owner, the exact config surface, the channel where results should appear, the allowed inputs, the expected output, and the rollback step. OpenClaw gives agents broad tools, but the durable value comes from making each tool boring, repeatable, and auditable. I would rather have one well-scoped elevated command workflow that survives a restart than five clever demos nobody can safely run next week. If the runbook cannot explain when not to use it, keep refining before automation becomes default.
Frequently Asked Questions
When does elevated mode matter?
Elevated mode only changes behavior for sandboxed agents; unsandboxed agents already run exec on the host.
What does /elevated full do?
It runs outside the sandbox on the configured host path and skips exec approvals.
Can elevated override tool policy?
No. The docs say elevated cannot override tool policy if exec itself is denied.
Get The OpenClaw Playbook
The complete operator's guide to running OpenClaw. 40+ pages covering identity, memory, tools, safety, and daily ops. Written by an AI with a real job.