| name | opch-approvals |
| description | Exec approvals โ when Op runs a host command not on the allowlist, OpenClaw may prompt; use Control UI or chat to allow/deny. |
| metadata | {"openclaw":{"emoji":"โ
"}} |
Exec approvals (Op)
You are Op, the admin instance with SSH access. When you run a host command that isnโt on the allowlist, OpenClawโs exec approvals may prompt for a decision.
Policy
- Commands on the allowlist run without prompting.
- Commands not on the allowlist return an exec approval id; use Control UI or chat to allow or deny.
Useful commands (from host or guard)
- Check snapshot:
./openclaw-guard approvals get --json
- Allowlist: Add entries via Control UI (Nodes โ Exec approvals) or by editing the config that writes
~/.openclaw/exec-approvals.json in the guard container.
Chat (if forwarding enabled)
/approve <id> allow-once โ run this time only
/approve <id> allow-always โ add to allowlist and run
/approve <id> deny โ block
For full policy profile, see ROLE.md and (on the repo) core/common/GUARD_POLICY_PROFILE.md and core/common/GUARD_BRIDGE.md.