Use this file to discover all available pages before exploring further.

Elevated mode

When an agent runs inside a sandbox, its

text

exec

commands are confined to the sandbox environment. Elevated mode lets the agent break out and run commands outside the sandbox instead, with configurable approval gates.

info

Elevated mode only changes behavior when the agent is **sandboxed**. For unsandboxed agents, exec already runs on the host.

Directives

Control elevated mode per-session with slash commands:

Directive	What it does
text `/elevated on`	Run outside the sandbox on the configured host path, keep approvals
text `/elevated ask`	Same as text `on` (alias)
text `/elevated full`	Run outside the sandbox on the configured host path and skip approvals
text `/elevated off`	Return to sandbox-confined execution

Also available as

text

/elev on|off|ask|full

Send

text

/elevated

with no argument to see the current level.

How it works

Check availability

Elevated must be enabled in config and the sender must be on the allowlist:


text
```json5}
{
  tools: {
    elevated: {
      enabled: true,
      allowFrom: {
        discord: ["user-id-123"],
        whatsapp: ["+15555550123"],
      },
    },
  },
}
```

Set the level

Send a directive-only message to set the session default:


text
```
/elevated full
```

Or use it inline (applies to that message only):

```
/elevated on run the deployment script
```

Commands run outside the sandbox

With elevated active, `exec` calls leave the sandbox. The effective host is `gateway` by default, or `node` when the configured/session exec target is `node`. In `full` mode, exec approvals are skipped. In `on`/`ask` mode, configured approval rules still apply.

Resolution order

Inline directive on the message (applies only to that message)
Session override (set by sending a directive-only message)
Global default (
text
agents.defaults.elevatedDefault
in config)

Availability and allowlists

Global gate:
text
tools.elevated.enabled
(must be
text
true
)
Sender allowlist:
text
tools.elevated.allowFrom
with per-channel lists
Per-agent gate:
text
agents.list[].tools.elevated.enabled
(can only further restrict)
Per-agent allowlist:
text
agents.list[].tools.elevated.allowFrom
(sender must match both global + per-agent)
Discord fallback: if
text
tools.elevated.allowFrom.discord
is omitted,
text
channels.discord.allowFrom
is used as fallback
All gates must pass; otherwise elevated is treated as unavailable

Allowlist entry formats:

Prefix	Matches
(none)	Sender ID, E.164, or From field
text `name:`	Sender display name
text `username:`	Sender username
text `tag:`	Sender tag
text `id:` , text `from:` , text `e164:`	Explicit identity targeting

What elevated does not control

Tool policy: if
text
exec
is denied by tool policy, elevated cannot override it
Host selection policy: elevated does not turn
text
auto
into a free cross-host override. It uses the configured/session exec target rules, choosing
text
node
only when the target is already
text
node
.
Separate from
text
/exec
: the
text
/exec
directive adjusts per-session exec defaults for authorized senders and does not require elevated mode

Exec tool — shell command execution
Exec approvals — approval and allowlist system
Sandboxing — sandbox configuration
Sandbox vs Tool Policy vs Elevated

OpenClaw Docs

Elevated mode

info

Directives

How it works

Check availability

Set the level

Commands run outside the sandbox

Resolution order

Availability and allowlists

What elevated does not control

Related