In exec-approvals.js, minSecurity has the rank order backwards:

function minSecurity(a, b) {
  const order = {
    deny: 0,
    allowlist: 1,
    full: 2
  };
  return order[a] <= order[b] ? a : b;
}

This treats full as the MOST restrictive (rank 2) instead of the LEAST restrictive. When resolveExecHostApprovalContext calls:

const hostSecurity = minSecurity(params.security, approvals.agent.security);

a session override of security="full" gets clamped down to the agent's security="allowlist" because order["full"] (2) > order["allowlist"] (1), so it returns "allowlist".

Note execSecurityFloorRank in the same file already uses the correct order where full=0 is least restrictive — so the fix is swapping minSecurity's order to match:

function minSecurity(a, b) {
  const order = {
    full: 0,
    allowlist: 1,
    deny: 2
  };
  return order[a] <= order[b] ? a : b;
}

Steps to reproduce:

1. Set exec.security: "full" in a session or config
2. Agent default/overrides have security: "allowlist"
3. Run any command → exec denied: allowlist miss

Impact: Users can never have per-session security="full" unless the agent config is also "full" (which applies to all sessions). The discord.execApprovals schema also lacks a security/ask field, so there's no way to set per-channel exec security either.

Found in: OpenClaw 2026.6.1

Related: #58691, #59079