多 Agent 最小权限实践：主 Agent 去权后需补齐 elevated gate

场景：`main` 只保留 `sessions_spawn` 后无法再委派高权限 lane。关键在于同时配置 `agentToAgent.allow` 与 `tools.elevated.allowFrom.<channel>`。

REDDITDiscovered 2026-02-14Author u/rutger-cas

Prerequisites

You run multi-agent architecture (main/router/lanes) and use sessions_spawn delegation.
You can edit runtime config for elevated policies per channel.

Steps

Strip privileged tools from `main` first (web/exec/process), keeping only orchestration tools.
Set explicit lane allowlist in `tools.agentToAgent.allow` for every delegable target agent.
Enable `tools.elevated` and configure `allowFrom.<channel>` with exact runtime identifier.
Run end-to-end spawn test from main → router → lane and confirm no `allowed:none` rejection.

Commands

openclaw gateway config.get

openclaw gateway restart

openclaw sessions list

Verify

Main agent stays least-privilege while delegation to approved lanes succeeds consistently.

Caveats

Community post is experiential; exact identifier format can differ by channel/runtime (needs verification).
Avoid wildcard elevated rules; they defeat least-privilege design.

Source attribution

This tip is aggregated from community/public sources and preserved with attribution.