Operators running OpenClaw on a macOS gateway in 2026 already route models and throttle 429 responses—but a single misclassified tool can still delete repositories, post to customer Slack channels, or run shell commands with production secrets. Tool execution approval and human-in-the-loop gates pause destructive calls until a human explicitly allows them, with timeouts and audit trails that survive channel restarts. This tutorial shows how to classify gateway tools, express approval policy in ~/.openclaw/openclaw.json, and rehearse holds on a staging port before LaunchAgent promotion. Pair it with doctor diagnostics, JSON and environment profiles, staging vs production profiles, upstream circuit breakers, and model failover routing when you need provider degradation—not as a substitute for approval.
You will leave with a threat model, a policy matrix template, configuration guardrails (120 s max pending approval, deny-on-timeout, separate staging channel), and a rollout checklist you can run on a rented Apple Silicon Mac mini for about $16.9 per day on published MacHTML pricing.
Why execution approval exists
Large language models are persuasive; they are not accountable. When a gateway exposes write, shell, or browser tools, a single hallucinated path can rm -rf a workspace, exfiltrate API keys from ~/.openclaw/.env, or post to a customer-facing Slack channel. Approval gates insert a human decision point before irreversible side effects, with explicit deny on timeout so bots do not hang silently.
Approval is not anti-automation—it is tiered risk control. Read-only tools can flow automatically; destructive tiers require a human tap in Slack, Telegram, or the macOS control UI. Document the tiers in a policy matrix your on-call team can read at 3 a.m. without opening source code.
Threat model for agent tools
Start from what your gateway can actually do on macOS: read arbitrary paths the LaunchAgent user owns, write into git repos, invoke shell with inherited environment variables, and drive a browser session with cookies. Attack surfaces include prompt injection via pasted HTML, compromised channel webhooks, and operators pasting production .env into staging chats.
Map each tool to blast radius: read (information disclosure), write (integrity loss), shell (full host compromise), browser (session riding). Any read that lists home directories should inherit write-tier approval unless paths are strictly allow-listed.
Policy matrix by channel and tool
| Tool class | Default mode | Notes |
|---|---|---|
| read / grep | Auto-approve | Reclassify if paths are not allow-listed |
| write / patch | Human approve | Show diff preview in Slack thread |
| shell | Always approve | Never auto-approve in production |
| browser | Approve + domain allow-list | Block file:// and internal IPs |
| DM / private channel | Stricter than #general | Assume higher sensitivity |
Publish the matrix beside your runbook. When product asks to “just auto-approve writes for speed,” require a named owner and a sunset date—otherwise every launch erodes the gate.
openclaw.json approval skeleton
Keep approval policy in ~/.openclaw/openclaw.json next to model routing, not in git-tracked HTML. Keys stay in ~/.openclaw/.env with chmod 600. A structural pattern separates tool classes, per-channel overrides, and timeout behavior.
{
"tools": {
"approval": {
"default": "auto",
"classes": {
"read": "auto",
"write": "human",
"shell": "human",
"browser": "human"
},
"pendingTimeoutMs": 120000,
"onTimeout": "deny"
},
"channels": {
"slack:#ops-alerts": { "write": "auto" },
"slack:#customer-support": { "shell": "deny" }
}
}
}Field names evolve between OpenClaw releases—diff against release notes before paste-deploying. After edits, run openclaw doctor and trigger one held tool call per class in staging.
Staging drills without production risk
Bind approval drills to a staging gateway port and workspace profile that never loads production secrets. Send canned prompts that request shell and write tools; confirm the gateway posts an approval card and blocks execution until you accept. Repeat with deny and timeout paths—operators must see a clear “denied after 120s” message, not a stuck “thinking…”
Pair drills with staging vs production LaunchAgent profiles. Never rehearse destructive approvals against customer databases from a laptop that also signs production plists.
Doctor checks and audit logs
After every approval policy change, capture openclaw doctor --json to the change ticket. Verify the gateway reports approval middleware healthy, channel webhooks reachable, and no orphan pending queues from crashed processes. Log correlation ids on approve/deny events so security can reconstruct a turn days later.
When doctor flags tool registration mismatches, fix JSON before promoting LaunchAgents—approving a tool name the gateway no longer exposes trains operators to click through errors.
Production rollout checklist
- Export fingerprints of
openclaw.json(not secrets) to git-ignored storage. - Classify every registered tool; update the policy matrix PDF/wiki.
- Run staging holds for write, shell, and browser; record screenshots.
- Enable human approval on production with deny-on-timeout at 120 s.
- Monitor pending queue depth; alert if > 5 concurrent holds.
- Document rollback: revert JSON +
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway.
FAQ
Should read-only tools skip approval?
Yes for pure reads with path allow-lists; reclassify broad directory listings.
Does approval slow Slack bots too much?
Batch per turn; keep timeouts at 120s with explicit deny messages.
How do I test without production risk?
Use staging profiles and synthetic tool calls—never production secrets on a laptop.
Renting an Apple Silicon Mac mini through MacHTML keeps approval drills on the same WebKit, Keychain, and Node builds your executives use—not a Linux container approximating macOS. Nodes expose SSH for log tailing and optional VNC when GUI approve buttons need a real screen session. Idle power commonly sits near 6–12 W, so a week-long human-in-the-loop rehearsal costs less than one incident where a shell tool wipes a release branch.
Published pricing near $16.9 per day beats idle CapEx between audits. When the drill ends, stop the instance; your policy matrix remains in docs while metal does not accumulate across 36 months.
Rehearse OpenClaw tool approval on real macOS
Rent a cloud Mac mini to validate human-in-the-loop gates, timeout behavior, and doctor probes before you promote approval policy to production LaunchAgents.