$cd ../troubleshooting/
No File Permissions After v2026.3.2 Upgrade
// The 2026.3.2 security rewrite changed the default tools.profile from 'full' to 'session'. This breaks existing setups that rely on file read/write/exec access.
β Who is Affected
Anyone upgrading from v2026.3.1 or earlier to v2026.3.2+. New fresh installs are not affected (they go through the onboarding wizard which configures tools.profile correctly).
diagnose.sh
π Diagnose the Problem
βYour agent says 'I don't have permission to read/write files'
βThe agent can't install new skills or run commands
βYou see 'EPERM' or 'access denied' in gateway logs
fix_permissions.sh
β Fix 1 β Set Tools Profile to 'coding' (Recommended)
Edit this file:
~/.openclaw/openclaw.json
# Set profile to 'coding'
{
"tools": {
"profile": "coding"
}
}# Then restart the gateway
openclaw gateway restart
allowlist_tools.json
β Fix 2 β Explicitly Allowlist Specific Tools
# Manually allowlist individual tools
{
"tools": {
"profile": "session",
"allow": ["read_file", "write_file", "run_bash", "list_dir"]
}
}re_onboard.sh
β Fix 3 β Re-run Onboarding Wizard
# Re-runs the setup wizard β will reconfigure tools.profile
openclaw setup
β Do NOT do this
Setting 'profile: "full"' without an allowlist grants the agent unrestricted access to your filesystem. Only use this in an isolated/sandboxed environment.
β FAQ
Q1. Why was the default changed to 'session' in v2026.3.2?
Security hardening in response to reported prompt injection attacks. The 'session' profile prevents the agent from reading/writing files outside its working directory and from executing arbitrary system commands. Previous users of 'full' profile had cases where a specially crafted user message caused the agent to exfiltrate or overwrite local files. The new default is opt-in safety: you choose which permissions to re-grant.
Q2. Is 'full' profile safe to use?
It depends on your threat model. If you're running OpenClaw on a private home network and all inputs come from you personally, 'full' is practical. If your bot is connected to Telegram/WhatsApp and receives messages from arbitrary users, or if it's accessible via a public URL, avoid 'full' without careful review. Instead, use 'session' or 'coding' with an explicit allowlist of only the specific tools your workflow needs.
Q3. Can I set different profiles per channel or per agent?
Yes. In config.yaml, each channel and each individual agent can have its own tools.profile override. For example: keep Telegram on 'session' (untrusted public input) but set your local CLI sessions to 'coding'. Individual agents can further restrict or expand beyond the channel default. This lets you safely open up permissions for trusted workflows without changing the global default.
Q4. What's the difference between 'session', 'coding', and 'full' profiles?
'session' β safest: agent can only read/write files in the current session working directory, no shell execution. 'coding' β balanced: adds read_file, write_file, list_dir, and run_bash with path restrictions to your project directories. This is the recommended profile for users who need file access for coding workflows. 'full' β unrestricted: all tools enabled, all paths accessible, full shell execution. Use only in air-gapped or fully trusted environments.
Q5. How do I know which tools my agents are currently using?
Enable 'log_level: debug' in your gateway config and restart. Every tool call will be logged with the tool name, arguments, and which agent triggered it. You can also check 'openclaw tools list --profile <name>' to see which tools are enabled under each profile. This helps you build a minimal allowlist β start with the debug log to see what's actually being called, then set exactly those tools in the allow array.
Q6. My skills stopped working after the upgrade. Is this related?
Yes, likely. Skills that install dependencies, write files, or run shell commands depend on tool access. The 'github' skill (which runs git commands), the 'summarize' skill (which may write temp files), and any custom skill that uses run_bash will all fail in 'session' mode. The fix is either switching to 'coding' profile (which covers most skill use cases) or adding the specific tools to the allow list: 'allow: [run_bash, write_file, read_file]'.