Enforce fail-closed defaults for unsafe tool execution

[davidahmann]

Problem

Unsafe tool execution can proceed under permissive defaults when safety configuration is incomplete, increasing blast radius in autonomous crew execution.

Why now

CrewAI adoption in multi-agent automation makes strict default safety posture more important for predictable operations.

Evidence Packet

• Version/commit under test: origin/main at 8102d0a6cade
• Runtime environment: macOS 26.3 (arm64), Python 3.14.0
• Minimal repro:
  1. Configure crew with unsafe/high-impact tool.
  2. Leave safety policy/confirmation config incomplete.
  3. Execute crew run path.
• Expected behavior: fail-closed block until explicit allow/confirmation policy is set.
• Actual behavior: safety defaults are not uniformly strict at tool execution boundaries.

Why code change (not docs)

Runtime safety policy must be enforced in execution codepaths.

Scope / Codepaths

• lib/crewai/src/crewai/tools
• lib/crewai/src/crewai/security
• lib/crewai/src/crewai/crews

Acceptance Criteria

• Unsafe tools denied by default without explicit policy.
• Deterministic error classification and messaging.
• Regression tests for allow/deny paths.

Validation Plan

• Add targeted unit tests for incomplete safety config.
• Verify fail-closed behavior in crew execution path.

[github-actions]

This issue is stale because it has been open for 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.