Bug type

Regression (worked before, now fails)

Summary

Bug: When an agent has tools.profile: "messaging" with a specific alsoAllow list that does NOT include exec, the exec tool is still available.

Steps to reproduce

Steps to reproduce:

Set global config tools.exec: { security: "full", ask: "off" }
Create agent with tools.profile: "messaging" and explicit alsoAllow list that excludes exec
Restart gateway and session
Try to use exec tool → it still works

Expected behavior

Expected: exec should be blocked for that agent since it's not in alsoAllow.

Actual behavior

Actual: exec is available regardless of agent profile.

OpenClaw version

Environment: OpenClaw 2026.3.12

Operating system

Linux 6.8.0-101-generic (x64)

Install method

npm global (npm i -g openclaw)

Model

ollama/minimax-m2.5:cloud

Provider / routing chain

Direct → Ollama Cloud

Config file / key location

/data/.openclaw/openclaw.json

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

Affected users/systems/channels: Anyone wanting to use agent-specific tool restrictions
Severity: blocks workflow / security issue – If you want to disable exec for an agent, it still gets allowed
Frequency: always (100% repro)
Consequence: Tool restrictions don't work as documented; security model is bypassed

Additional information

No response