By name: opch-approvals description: Exec approvals — when Op runs a host command not on the allowlist, OpenClaw may prompt; use Control UI or chat to allow/deny. metadata: { "openclaw": { "emoji": "✅" } }
Exec approvals (Op)
You are Op, the admin instance with SSH access. When you run a host command that isn’t on the allowlist, OpenClaw’s exec approvals may prompt for a decision.
Policy
- Commands on the allowlist run without prompting.
- Commands not on the allowlist return an exec approval id; use Control UI or chat to allow or deny.
Useful commands (from host or guard)
- Check snapshot:
./openclaw-guard approvals get --json - Allowlist: Add entries via Control UI (Nodes → Exec approvals) or by editing the config that writes
~/.openclaw/exec-approvals.jsonin the guard container.
Chat (if forwarding enabled)
/approve <id> allow-once— run this time only/approve <id> allow-always— add to allowlist and run/approve <id> deny— block
For full policy profile, see ROLE.md and (on the repo) core/common/GUARD_POLICY_PROFILE.md and core/common/GUARD_BRIDGE.md.