# Generated by Ansible (Hardened Tier 3)
tools:
  shell:
    enabled: true
    allowlist:
      - "ls"
      - "cat"
      - "grep"
      - "head"
      - "tail"
      - "find"
      - "wc"
      - "sort"
      - "uv"
      - "python3"

  filesystem:
    enabled: true
    allowedPaths:
      - "{{ openclaw_home }}/workspace"
      - "{{ openclaw_home }}/.openclaw/skills"
    deniedPaths:
      - "{{ openclaw_home }}/.ssh"
      - "{{ openclaw_home }}/.openclaw/credentials"
      - "/etc"
