diff --git a/README.ja.md b/README.ja.md
index a7f43b9a7..ee00076ca 100644
--- a/README.ja.md
+++ b/README.ja.md
@@ -177,6 +177,7 @@ picoclaw onboard
   "agents": {
     "defaults": {
       "workspace": "~/.picoclaw/workspace",
+      "allow_patterns": [],
       "model": "glm-4.7",
       "max_tokens": 8192,
       "temperature": 0.7,
@@ -464,7 +465,8 @@ PicoClaw はデフォルトでサンドボックス環境で実行されます
   "agents": {
     "defaults": {
       "workspace": "~/.picoclaw/workspace",
-      "restrict_to_workspace": true
+      "restrict_to_workspace": true,
+      "allow_patterns": []
     }
   }
 }
@@ -474,6 +476,25 @@ PicoClaw はデフォルトでサンドボックス環境で実行されます
 |-----------|-----------|------|
 | `workspace` | `~/.picoclaw/workspace` | エージェントの作業ディレクトリ |
 | `restrict_to_workspace` | `true` | ファイル/コマンドアクセスをワークスペースに制限 |
+| `allow_patterns` | `[]` | `exec` コマンド文字列に対する正規表現 allowlist。設定時は少なくとも1つに一致する必要があります |
+
+`allow_patterns` はコマンド全体に対して（大文字小文字を区別せず）評価されます。空配列なら allowlist 制限は無効です。
+
+例:
+
+```json
+{
+  "agents": {
+    "defaults": {
+      "allow_patterns": [
+        "^ls(\\s|$)",
+        "^pwd$",
+        "^cat\\s+README\\.md$"
+      ]
+    }
+  }
+}
+```
 
 #### 保護対象ツール
 
diff --git a/README.md b/README.md
index e80e2213c..49313e527 100644
--- a/README.md
+++ b/README.md
@@ -209,6 +209,7 @@ picoclaw onboard
   "agents": {
     "defaults": {
       "workspace": "~/.picoclaw/workspace",
+      "allow_patterns": [],
       "model": "glm-4.7",
       "max_tokens": 8192,
       "temperature": 0.7,
@@ -504,7 +505,8 @@ PicoClaw runs in a sandboxed environment by default. The agent can only access f
   "agents": {
     "defaults": {
       "workspace": "~/.picoclaw/workspace",
-      "restrict_to_workspace": true
+      "restrict_to_workspace": true,
+      "allow_patterns": []
     }
   }
 }
@@ -514,6 +516,25 @@ PicoClaw runs in a sandboxed environment by default. The agent can only access f
 |--------|---------|-------------|
 | `workspace` | `~/.picoclaw/workspace` | Working directory for the agent |
 | `restrict_to_workspace` | `true` | Restrict file/command access to workspace |
+| `allow_patterns` | `[]` | Optional regex allowlist for `exec` command content. If set, commands must match at least one pattern |
+
+`allow_patterns` is matched against the full command (case-insensitive). Keep it empty to disable allowlist filtering.
+
+Example:
+
+```json
+{
+  "agents": {
+    "defaults": {
+      "allow_patterns": [
+        "^ls(\\s|$)",
+        "^pwd$",
+        "^cat\\s+README\\.md$"
+      ]
+    }
+  }
+}
+```
 
 #### Protected Tools
 
@@ -693,6 +714,7 @@ The subagent has access to tools (message, web_search, etc.) and can communicate
   "agents": {
     "defaults": {
       "workspace": "~/.picoclaw/workspace",
+      "allow_patterns": [],
       "model": "glm-4.7",
       "max_tokens": 8192,
       "temperature": 0.7,
diff --git a/README.zh.md b/README.zh.md
index e7dc8d769..f3d2b086b 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -218,6 +218,7 @@ picoclaw onboard
   "agents": {
     "defaults": {
       "workspace": "~/.picoclaw/workspace",
+      "allow_patterns": [],
       "model": "glm-4.7",
       "max_tokens": 8192,
       "temperature": 0.7,
@@ -462,6 +463,48 @@ PicoClaw 将数据存储在您配置的工作区中（默认：`~/.picoclaw/work
 
 ### 心跳 / 周期性任务 (Heartbeat)
 
+### 🔒 安全沙箱 (Security Sandbox)
+
+默认情况下，PicoClaw 在沙箱中运行，Agent 仅能在工作区内访问文件与执行命令。
+
+```json
+{
+  "agents": {
+    "defaults": {
+      "workspace": "~/.picoclaw/workspace",
+      "restrict_to_workspace": true,
+      "allow_patterns": []
+    }
+  }
+}
+```
+
+| 选项 | 默认值 | 描述 |
+| --- | --- | --- |
+| `workspace` | `~/.picoclaw/workspace` | Agent 工作目录 |
+| `restrict_to_workspace` | `true` | 限制文件/命令访问仅在工作区内 |
+| `allow_patterns` | `[]` | 可选：对 `exec` 命令内容做正则白名单匹配；设置后命令必须命中至少一条规则 |
+
+`allow_patterns` 会对完整命令进行匹配（不区分大小写）。为空数组时，不启用白名单过滤。
+
+示例：
+
+```json
+{
+  "agents": {
+    "defaults": {
+      "allow_patterns": [
+        "^ls(\\s|$)",
+        "^pwd$",
+        "^cat\\s+README\\.md$"
+      ]
+    }
+  }
+}
+```
+
+> ⚠️ 说明：`allow_patterns` 只影响 `exec` 工具；仍受 `restrict_to_workspace` 约束。
+
 PicoClaw 可以自动执行周期性任务。在工作区创建 `HEARTBEAT.md` 文件：
 
 ```markdown
@@ -570,6 +613,7 @@ Agent 读取 HEARTBEAT.md
   "agents": {
     "defaults": {
       "workspace": "~/.picoclaw/workspace",
+      "allow_patterns": [],
       "model": "glm-4.7",
       "max_tokens": 8192,
       "temperature": 0.7,