let5see/clawdbot
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

docs: clarify command authorization for exec directives

Browse Source
This commit is contained in:
Peter Steinberger
2026-01-26 22:18:36 +00:00
parent 9c0c5866db
commit 0f8f0fb9d7
8 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/tools/exec-approvals.md
View File

@@ -216,6 +216,9 @@ Approval-gated execs reuse the approval id as the `runId` in these messages for
- **full** is powerful; prefer allowlists when possible.
- **ask** keeps you in the loop while still allowing fast approvals.
- Per-agent allowlists prevent one agent’s approvals from leaking into others.
- Approvals only apply to host exec requests from **authorized senders**. Unauthorized senders cannot issue `/exec`.
- `/exec security=full` is a session-level convenience for authorized operators and skips approvals by design.
To hard-block host exec, set approvals security to `deny` or deny the `exec` tool via tool policy.
Related:
- [Exec tool](/tools/exec)