Summary

When security: allowlist is configured for exec approvals, patterns match against the resolved binary path (e.g., /bin/zsh). This means an agent can bypass the allowlist by running dangerous commands through an allowed shell:

exec: zsh -c "openclaw gateway stop"

/bin/zsh matches the allowlist, so the command executes — even though openclaw gateway stop should be blocked.

Requested Feature

Add deny patterns that match against the full command string, not just the binary path. These would be evaluated before the allowlist and would block matching commands regardless of how they're invoked.

Example config in exec-approvals.json:

{
  "agents": {
    "main": {
      "denylist": [
        { "pattern": "*openclaw gateway*" },
        { "pattern": "*npm install*openclaw*" },
        { "pattern": "*launchctl bootout*" }
      ],
      "allowlist": [...]
    }
  }
}

Use Case

An AI agent that runs inside the gateway needs shell access (zsh, bash) for legitimate work, but must be mechanically prevented from stopping/restarting the gateway it lives inside of. Soft rules (system prompt instructions) are insufficient — the agent has crashed its own gateway multiple times by bypassing written procedures under momentum pressure.

Current Workaround

• System prompt keyword scanning (agent checks for dangerous keywords before exec calls)
• Written rules in agent identity files
• These are soft guardrails only — not mechanical enforcement

Environment

• OpenClaw 2026.3.7
• macOS, launchd-managed gateway with KeepAlive
• Agent uses security: allowlist with ask: on-miss and askFallback: deny