Problem

Currently, tool policies are static configuration that apply globally regardless of which model is active. This creates a dilemma:

• Small local models (≤300B params) are blocked as fallbacks when web tools are enabled, even though they could safely handle most tasks
• Manual workaround requires editing config + restarting the gateway when switching between models
• Users can't leverage local fallbacks for cost savings without sacrificing web tool access on primary models

Use Case

Users with mixed model setups want to:

• Use expensive API models (Claude, GPT-5) with full tool access for complex work
• Fall back to local/smaller models for basic chat when API credits run out
• Have the local model run safely (without web tools) without manual intervention
• Automatically restore full tool access when the API model is available again

Proposed Solution

Support per-model tool policies via tools.byModel or similar:

{
  "agents": {
    "defaults": {
      "model": {
        "primary": "anthropic/claude-sonnet-4-5",
        "fallbacks": ["ollama/gpt-oss:20b"]
      }
    }
  },
  "tools": {
    "web": {
      "search": { "enabled": true }
    },
    "byModel": {
      "ollama/gpt-oss:20b": {
        "deny": ["web_search", "web_fetch", "browser"]
      }
    }
  }
}

When OpenClaw switches models (whether via fallback, explicit switch, or any other mechanism), it would:

1. Check if the active model has specific tool restrictions
2. Merge/apply those restrictions on top of the base tool policy
3. Restore base policy when switching back

Current Workaround

None that's practical. Users must either:

• Manually edit config when credits run out (then restart gateway)
• Remove web tools entirely (losing functionality on capable models)
• Not use local fallbacks at all

Benefits

• Safe fallback behavior - small models can serve as backup without security risks
• Cost optimization - users can ride out API credit exhaustion without service interruption
• No manual intervention - tool policies adjust automatically based on active model
• Backwards compatible - only applies when tools.byModel is configured

Related

• Related to [Feature Request] Natural language model switching in conversation #6717 (natural language model switching)
• Complements the existing security policy that blocks small models + web tools
• Would make local fallbacks actually usable in real-world scenarios

Environment

• OpenClaw 2026.2.1
• Primary: anthropic/claude-sonnet-4-5
• Fallback candidate: ollama/gpt-oss:20b (currently blocked by security policy)