docs: clarify native node approval docs

vincentkoc · vincentkoc · commit 568c7c729aeb · 2026-05-31T23:36:15.000+02:00
diff --git a/docs/gateway/pairing.md b/docs/gateway/pairing.md
@@ -76,7 +76,8 @@ Notes:
   extra approval scopes:
   - commandless request: `operator.pairing`
   - non-exec command request: `operator.pairing` + `operator.write`
-  - `system.run` / `system.run.prepare` / `system.which` request:
+  - `system.run` / `system.run.prepare` / `system.which` /
+    `system.execApprovals.*` request:
     `operator.pairing` + `operator.admin`
 
 <Warning>
diff --git a/docs/tools/exec-approvals.md b/docs/tools/exec-approvals.md
@@ -417,6 +417,13 @@ Nodes must advertise `system.execApprovals.get/set` (macOS app or
 headless node host). If a node does not advertise exec approvals yet,
 edit its local `~/.openclaw/exec-approvals.json` directly.
 
+Some node hosts, including native Windows hosts, expose host-native
+approval snapshots instead of a file-backed OpenClaw approvals file. The
+Control UI shows those snapshots as read-only because the native host owns
+the policy format and editor. Use the Windows companion app or
+`openclaw approvals set --node <id|name|ip>` for supported updates on
+those nodes.
+
 CLI: `openclaw approvals` supports gateway or node editing - see
 [Approvals CLI](/cli/approvals).
 
