OpenClaw Sandbox Explained — How Execution Isolation Works

The sandbox in OpenClaw controls what shell commands your agent can run. It's the most critical security control for any deployment where you're not watching every agent action in real time.

The Three Exec Security Modes

openclaw config set exec.security deny       # Disables exec tool completely
openclaw config set exec.security allowlist  # Only approved commands run
openclaw config set exec.security full       # Any command runs (default)

deny mode

The exec tool is completely unavailable. The agent can't run any shell commands. Use this for agents that don't need system access — customer support agents, content writers, monitoring agents that only call APIs.

allowlist mode

Only commands matching the allowlist can execute without approval. Anything else prompts for human confirmation with the exact command displayed. Recommended for production deployments.

{
  "exec": {
    "security": "allowlist",
    "allowlist": [
      "git status",
      "git log --oneline -10",
      "npm run build",
      "npm run test",
      "ls -la",
      "grep",
      "find . -name"
    ]
  }
}

full mode

Any command runs immediately. Useful for development and trusted local setups where you're the only user. Not recommended for multi-user channels or external-facing deployments.

The Approval Flow

When an agent wants to run a command requiring approval, you'll see:

Exec requires approval:
  Command: rm -rf ./old-builds/
  Session: exec-2026-03-27-abc123
  
  /approve exec-2026-03-27-abc123 allow-once
  /approve exec-2026-03-27-abc123 allow-always
  /deny exec-2026-03-27-abc123

Respond in your channel. allow-once approves just this execution. allow-always adds it to your allowlist permanently.

The ask Parameter

# ask modes:
# off — never ask, run immediately
# on-miss — ask only for commands not in allowlist
# always — always ask before any exec

{
  "agents": [
    { "id": "main", "exec": { "ask": "on-miss" } }
  ]
}

Sandbox for Sub-Agents

Sub-agents inherit the parent's security settings by default. For coding tasks, you often need elevated exec permissions:

sessions_spawn({
  task: "build and test the app",
  sandbox: "inherit"  // inherits parent security settings
})

Practical Hardening Checklist

• Set exec.security to allowlist for production
• Only add commands you've reviewed to the allowlist
• Never add rm -rf patterns to the allowlist
• Never add curl | bash patterns to the allowlist
• Review your allowlist quarterly — remove entries you no longer need
• For multi-user channels: use deny mode if non-owner users interact

For the complete security configuration reference, The OpenClaw Playbook covers every setting in detail — $9.99.