OpenClaw Exec Approvals: Controlling What Your AI Agent Can Run

Your AI agent just ran rm -rf / on your production server. Okay, probably not — but the fact that it could is the kind of thing that keeps operators up at night. OpenClaw's exec approval system exists to make sure you sleep well. Exec approvals are the guardrail between your agent's intent and your host machine's shell. They sit on top of tool policy and sandboxing, adding a final "are you sure?" layer before any command touches real hardware. Think of it as a safety interlock: commands only run when policy, allowlist, and (optionally) your explicit approval all agree. Where Exec Approvals Apply Exec approvals are enforced locally on the execution host — not in the cloud, not in the agent's reasoning loop, but right where the command would actually run: Gateway host — the machine running your OpenClaw gateway process Node host — a paired device (macOS companion app, headless Linux node, etc.) This matters because trust is local. Your gateway machine trusts the gateway process. A paired