What is an operation-scoped approval?

An authorization attached to one exact operation with its arguments fixed — send, to this address, with this template — rather than to the tool that performs it. It is created as a named record, so it can be listed, audited and revoked on its own.

Why is a tool-wide grant risky?

Because it stays in force after the task that prompted it, and it covers every operation and every argument the tool accepts. Anything that later steers the agent, including an instruction hidden in content the agent reads, inherits that whole surface without asking again.

Does this mean approving every single action by hand?

No. A recurring automation is approved once, for an exact operation, and then re-runs under that same bounded grant. The approval is narrow rather than frequent — closer to a standing bank order than to signing each payment.

How does this relate to capability scoping?

It is capability scoping at the finest useful granularity. Scoping asks what the agent may do; an operation-scoped approval answers with an operation and its arguments rather than with the name of a tool, which is what makes the answer revocable one line at a time.

Agent· 2026-09-07

OpenClaw 2.0 scopes automation approvals to one operation — Operation-scoped approvals — What does it mean?

TL;DR

What is it: The news anchor is OpenClaw 2.0, the open-source agent runtime released on September 1, 2026, and the concept it makes concrete is the operation-scoped approval — a grant attached to one exact operation with its arguments fixed, rather than to the tool that performs it.
Why it’s needed: An agent's standing permissions are the budget a prompt injection gets to spend, so what decides your blast radius is not whether you approved something, but how much you approved when you clicked yes.
vs previous: The previous approach was the session-wide or tool-wide grant — approve the email tool once and every later send is pre-authorized, including the sends an attacker wrote — whereas an operation-scoped grant names its arguments, expires as a unit, and can be revoked without taking the tool away.

Jargon

Capability scoping: Deciding what an agent is allowed to do, and at what granularity, before it does anything. The granularity is the whole decision. Scope a capability →
Standing grant: A permission that stays in force after the action that prompted it has finished. Approve the tool once and every later call through that tool is pre-authorized.
Policy enforcement: A layer that checks a proposed action against a rule before it runs, rather than checking the model's text after the fact. How the guardrail layers stack →
Fail-safe vs fail-open: What the harness does when the check itself cannot run — no approver is awake, the policy service is down. Fail-safe refuses; fail-open lets the call through. Pick one deliberately →
Confused deputy: A component holding more authority than its caller deserves, tricked into using that authority on the caller's behalf. An agent carrying a standing grant is a deputy waiting to be confused.
Prompt injection: Instructions smuggled into content the agent reads — a web page, an email, a tool result — which the model then follows as if you had written them. The agent is not broken; it is obeying the wrong author.
Blast radius: How much an attacker reaches once one thing goes wrong. For approvals it is simply the set of actions that a single yes authorizes.

The news. On September 1, 2026, the OpenClaw project released OpenClaw 2.0, rebuilding its agent runtime around durable sessions, paired local and cloud workers, and permission boundaries made explicit in the harness. Interactive results carry actions and network access that are granted individually, and a recurring automation can be approved for an exact operation instead of inheriting broad permission. Credentials, separately, are requested through a masked prompt and kept out of model-visible context. Read the release notes →

Hold the two pieces of paper side by side. A signature stamp signs whatever is pressed under it — a cheque, a contract, a blank page someone slid into the stack. A written cheque carries the same signature but only works once, for one payee, one amount, one date. The signature is identical in both cases; what differs is how much the holder can do with it, and that is the whole of the idea.

An agent permission is the same object. When you click allow on a tool, you are choosing which of those two you just handed over. The tool-wide answer says the agent may call send_email, from now on, with whatever arguments it later decides on. The operation-scoped answer says the agent may call send_email with this recipient and this template, and the grant is a record you can list, inspect and cancel. The agent's capability did not change. The set of actions a later instruction can reach did.

That set is the thing an attacker inherits. Untrusted content the agent reads can carry instructions and the model cannot reliably tell them from yours, so the defensive question stops being will the agent be fooled and becomes what is already authorized when it is. A scoped approval does not make the model harder to fool; it makes being fooled cheaper.

Agent proposestool plus arguments

Policy checkdoes a grant match?

Scoped grantthis recipient, this template

Runs, or refusesno standing yes to fall back on

Grant shape	What it authorizes	When it ends	What an injection inherits
Session-wide	every tool, for as long as the session runs	when the session does	everything the agent can do
Tool-wide	every operation and every argument of one tool	usually never — it is standing	the full surface of that tool
Operation-scoped	one operation, with its arguments fixed	on revocation, as a named unit	that one operation, unchanged

Put numbers on it (illustrative). Say the agent has one email tool with three operations — send, read, delete — and an address book of twelve recipients. A tool-wide grant authorizes every combination of the two: 3 × 12 = 36 distinct actions, and it stays authorized after the task that prompted it is finished. The operation-scoped grant for a weekly report authorizes send, to one address, with one template: 1 action, valid until you revoke that automation.

Both were one click. One click bought 36 standing actions and the other bought 1 — and the difference is not what the agent can do, it is what an injected instruction inherits. The second shape also leaves you something to revoke. A tool-wide grant can only be withdrawn by withdrawing the tool, which breaks the legitimate task along with the risk; a list of named operations can be cancelled one at a time, the way you stop one standing order without closing the account.

There is a cost, and it lands on unattended runs. A scoped grant has to be created by somebody, and an agent working overnight has nobody to ask — which is why this design forces you to answer a question you could previously leave implicit: what happens when the check cannot run. Fail-open turns every scoped approval back into a standing one at exactly the moment you were not watching. Fail-safe means the overnight run stops and waits.

The honest reading is that scoped approvals move work rather than remove it. You now maintain a list of operations instead of a list of tools, and the list is longer. What you buy is that the list is enumerable — you can read it, hand it to an auditor, and delete one line — which a standing grant on a general-purpose tool never is. It also pairs with the release's other mechanism: the credential isolation proxy keeps the secret out of the model's reach, and the scoped approval bounds what the agent may do with the secret it can no longer read.

Goes deeper in: AI Agents → Security & the Lethal Trifecta → Capability Scoping

Related explainers

OpenClaw 2.0 keeps secrets out of the model's context — the other half of the same release: where the secret lives, rather than what the agent is allowed to do with it.

Frequently Asked Questions

Check what you knowMap your AI & GPU knowledge across every track — free, role-based