ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

Clarify directive persistence authorization policy [AI] (#86369)

Browse Source 
* fix: require admin scope for persisted directive defaults

* addressing codex review

* fix: complete directive persistence scope gate

* addressing review-skill

* fix: preserve channel directive persistence

* fix: require admin scope for directive default persistence

* addressing codex review

* fix: complete directive persistence scope handling

* addressing codex review

* fix: complete directive persistence gate

* addressing review-skill

* fix: complete directive persistence gate

* addressing review-skill

* clarify directive persistence policy

* docs: add changelog entry for PR merge
This commit is contained in:
Pavan Kumar Gondhi
2026-05-28 15:20:47 +05:30
committed by GitHub
parent dc5671edae
commit bb418a857e
10 changed files with 246 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tools/exec.md
+4 -3
View File
@@ -164,9 +164,10 @@ Example:
## Authorization model
`/exec` is only honored for **authorized senders** (channel allowlists/pairing plus `commands.useAccessGroups`).
It updates **session state only** and does not write config. To hard-disable exec, deny it via tool
policy (`tools.deny: ["exec"]` or per-agent). Host approvals still apply unless you explicitly set
`security=full` and `ask=off`.
It updates **session state only** and does not write config. Authorized external channel senders may
set these session defaults. Internal gateway/webchat clients need `operator.admin` to persist them.
To hard-disable exec, deny it via tool policy (`tools.deny: ["exec"]` or per-agent). Host approvals
still apply unless you explicitly set `security=full` and `ask=off`.
## Exec approvals (companion app / node host)