OpenClaw Sandbox Permission Denied — How to Fix It 2026

"Permission denied" in OpenClaw's sandbox means your agent tried to run a command that isn't in its allowlist. Here's exactly how to fix it without compromising security.

Identify the Blocked Command

# Check gateway logs for the denied command:
openclaw gateway logs --tail 50 | grep -i "denied\|permission\|blocked"

# You'll see something like:
# [sandbox] Command denied: 'brew install ...' not in allowlist
# [sandbox] Exec blocked: 'pip3' requires approval

Option 1: Add to Allowlist (Permanent Fix)

# Edit openclaw.json:
{
  "security": {
    "exec": {
      "mode": "allowlist",
      "allowedCommands": [
        "curl", "python3", "node", "npm", "git",
        "pip3",        // ADD THIS
        "brew",        // ADD THIS
        "jq", "date"
      ]
    }
  }
}

# Restart gateway for changes to take effect:
openclaw gateway restart

Option 2: Approve One-Time via CLI

# When the agent requests approval in Slack/terminal:
# Agent: "Requesting approval to run: pip3 install requests"

# Approve this one execution:
/approve allow-once abc123

# Or deny it:
/approve deny abc123

Option 3: Change Sandbox Mode (Less Secure)

# For a personal/trusted deployment, switch to full mode:
{
  "security": {
    "exec": {
      "mode": "full"
    }
  }
}

# WARNING: This allows the agent to run ANY command.
# Only do this on a machine you fully control.

Checking Your Current Allowlist

cat ~/.openclaw/openclaw.json | python3 -m json.tool | grep -A 30 '"allowedCommands"'

Common Commands That Need Adding

"allowedCommands": [
  // Standard Unix:
  "ls", "cat", "grep", "find", "head", "tail",
  "mkdir", "cp", "mv", "rm",
  "wc", "sort", "uniq", "sed", "awk",
  "date", "echo", "printf", "env",
  
  // Development:
  "git", "npm", "npx", "node",
  "python3", "pip3",
  "docker", "docker-compose",
  
  // Network:
  "curl", "wget", "ssh", "scp",
  "ping", "dig", "nslookup",
  
  // Data tools:
  "jq", "yq", "csv2json"
]

File System Permission Denied (Different Issue)

# If the error is OS-level permission (not sandbox):
ls -la ~/.openclaw/workspace/

# Fix file ownership:
chown -R $USER ~/.openclaw/
chmod -R 755 ~/.openclaw/workspace/

# Check if a specific file is locked:
lsof | grep filename

Get the complete setup guide in The OpenClaw Playbook — everything you need to master OpenClaw for $9.99.