OpenClaw 2026.3.28 adds Responses API support and plugin permission prompts

• OpenClaw's 2026.3.28 update switched its xAI integration to the Responses API, a change the maintainer said users had been requesting since an earlier issue.
• The same release added a new plugin security control: according to the feature note, plugins can now "ask for the user’s permission" during behavior execution.
• Early upgrade feedback was mixed. In a Reddit report, one user said moving from 3.24 to 3.28 broke /v1/models with a forbidden error for "missing scope: operator.write."

The headline change is an xAI integration swap. OpenClaw's reposted maintainer note says 2026.3.28 now uses the Responses API, framing it as a long-requested update rather than a brand-new integration path. Separately, OpenClaw's security feature note says plugins can now request user approval "during the behavior," which narrows plugin access behind an explicit permission prompt instead of assuming the action should proceed.

A Reddit user reported a concrete regression immediately after upgrading: /v1/models started returning {'ok': False, 'error': {'type': 'forbidden', 'message': 'missing scope: operator.write'}}, and they said rolling back to 3.24 restored the prior behavior. That does not establish a general release-wide bug, but it does suggest 3.28 may change auth or scope expectations in some setups; the only corroborating community reply was a blunt warning not to touch "a perfectly working setup" without expecting fallout thread discussion.