<!-- source: https://deepwiki.com/openclaw/openclaw/4.3-policy-and-access-control -->

# Policy & Access Control

- docs/channels/groups.md
- docs/channels/slack.md
- docs/gateway/config-channels.md
- extensions/bonjour/manifest.test.ts
- extensions/github-copilot/embeddings.test.ts
- extensions/matrix/src/matrix/monitor/inbound-dedupe.test.ts
- extensions/openai/auth-choice-copy.ts
- extensions/openai/openclaw.plugin.json
- extensions/openai/openclaw.plugin.test.ts
- extensions/openai/provider-contract-api.ts
- extensions/openai/setup-api.test.ts
- extensions/openai/setup-api.ts
- extensions/openrouter/music-generation-provider.test.ts
- extensions/openrouter/music-generation-provider.ts
- extensions/slack/src/approval-auth.ts
- extensions/slack/src/approval-handler.runtime.test.ts
- extensions/slack/src/approval-handler.runtime.ts
- extensions/slack/src/approval-native-gates.ts
- extensions/slack/src/approval-native.test.ts
- extensions/slack/src/approval-native.ts
- extensions/slack/src/monitor.test-helpers.ts
- extensions/slack/src/send.ts
- extensions/slack/src/send.unfurl.test.ts
- extensions/telegram/src/bot-handlers.runtime.ts
- extensions/telegram/src/bot.test.ts
- extensions/telegram/src/channel.message-adapter.test.ts
- extensions/telegram/src/message-cache.test.ts
- extensions/telegram/src/message-cache.ts
- extensions/telegram/src/model-buttons.test.ts
- extensions/telegram/src/model-buttons.ts
- extensions/telegram/src/outbound-message-context.ts
- extensions/telegram/src/outbound-params.test.ts
- extensions/telegram/src/outbound-params.ts
- extensions/telegram/src/status-reaction-variants.ts
- extensions/whatsapp/src/auto-reply/monitor/on-message.audio-preflight.test.ts
- extensions/whatsapp/src/auto-reply/monitor/on-message.ts
- extensions/whatsapp/src/inbound.media.test.ts
- src/config/types.messages.ts
- src/config/types.slack.ts
- src/plugin-sdk/test-helpers/provider-runtime-contract.ts
- src/plugins/activation-planner.test.ts
- src/plugins/plugin-registry.test.ts
- src/plugins/web-provider-resolution-candidates.test.ts

This page documents the access control mechanisms and messaging policies for messaging channels in OpenClaw. These policies determine which messages trigger agent responses, which senders are authorized to interact with the personal AI assistant gateway, and how sensitive operations (like tool execution and command access) are gated.

## Overview

OpenClaw utilizes a layered and flexible policy system to govern access across various messaging platforms. The system operates on a **personal assistant trust model**, assuming one trusted operator boundary per gateway [docs/gateway/config-channels.md21-24](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/gateway/config-channels.md?plain=1#L21-L24)

Key policy components include:

- DM (Direct Message) Policies : Specify handling of unknown direct message senders with modes like pairing , allowlist , open , or disabled docs/gateway/config-channels.md 25-30
- Group Policies : Dictate how group/room messages are gated, supporting requireMention gating and allowlist filtering docs/gateway/config-channels.md 32-36
- allowFrom Configuration : Provides explicit numeric ID allowlists for senders and groups docs/gateway/config-channels.md 118
- Channel Model Overrides : Pinning specific channels or topics to specific models via channels.modelByChannel docs/gateway/config-channels.md 44-47

Sources: [docs/gateway/config-channels.md21-47](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/gateway/config-channels.md?plain=1#L21-L47)

## DM Policy Modes

The `dmPolicy` setting governs how the gateway responds to messages received directly from unknown senders in one-on-one conversations. This is configured under `channels.<provider>.dmPolicy` [docs/gateway/config-channels.md115-117](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/gateway/config-channels.md?plain=1#L115-L117)

### Implementation Details

DM authorization is enforced during the message preflight phase. For Telegram, `enforceTelegramDmAccess` handles the validation of inbound direct messages against the configured policy [extensions/telegram/src/bot-handlers.runtime.ts103](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/bot-handlers.runtime.ts#L103-L103) Effective DM policies are resolved using `resolveTelegramEffectiveDmPolicy`, which merges global defaults with account-specific overrides [extensions/telegram/src/bot-handlers.runtime.ts49](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/bot-handlers.runtime.ts#L49-L49)

Sources: [docs/gateway/config-channels.md25-42](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/gateway/config-channels.md?plain=1#L25-L42) [extensions/telegram/src/bot-handlers.runtime.ts47-51](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/bot-handlers.runtime.ts#L47-L51)

## Group & Channel Policies

Group policies regulate whether group or room messages are processed and under which conditions.

### Supported Group Policies

### Mention Requirements

In groups, `requireMention` determines if the bot responds to all messages or only those where it is explicitly tagged. This can be configured globally for all groups via `groups: { "*": { requireMention: true } }` or per specific group ID [docs/gateway/config-channels.md124-125](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/gateway/config-channels.md?plain=1#L124-L125) In the Telegram implementation, `resolveGroupRequireMention` is passed to the handler registration to filter inbound events [extensions/telegram/src/bot-handlers.runtime.ts166](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/bot-handlers.runtime.ts#L166-L166)

### Default Fallbacks

If a provider-level `groupPolicy` is unset, the system falls back to `channels.defaults.groupPolicy`. If that is also missing, it defaults to `allowlist` (fail-closed) with a startup warning [docs/gateway/config-channels.md41-42](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/gateway/config-channels.md?plain=1#L41-L42)

Sources: [docs/gateway/config-channels.md32-42](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/gateway/config-channels.md?plain=1#L32-L42) [docs/gateway/config-channels.md123-128](https://github.com/openclaw/openclaw/blob/fbdf5937/docs/gateway/config-channels.md?plain=1#L123-L128) [extensions/telegram/src/bot-handlers.runtime.ts111-114](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/bot-handlers.runtime.ts#L111-L114)

## Technical Implementation: Access Resolution

Access evaluation follows a layered precedence model. The system maps incoming messages to internal session keys and authorization checks.

### Code Entity Mapping (Policy Components)

This diagram illustrates how configuration-level policies map to internal runtime entities in the Telegram plugin.

```

```

Sources: [extensions/telegram/src/bot-handlers.runtime.ts49-166](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/bot-handlers.runtime.ts#L49-L166) [extensions/telegram/src/dm-access.ts1-5](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/dm-access.ts#L1-L5) [extensions/telegram/src/group-access.ts1-5](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/group-access.ts#L1-L5)

## Allowlists and Sender Identifiers

Allowlists control interaction via `allowFrom` configuration. Identifiers are normalized based on the channel plugin's requirements.

### Code Entity Mapping (Authorization Flow)

The system uses specialized functions to resolve effective policies from complex merged configurations.

```

```

Sources: [extensions/telegram/src/bot-handlers.runtime.ts86-119](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/bot-handlers.runtime.ts#L86-L119) [extensions/telegram/src/bot/helpers.ts86-87](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/bot/helpers.ts#L86-L87) [extensions/telegram/src/ingress.ts117-119](https://github.com/openclaw/openclaw/blob/fbdf5937/extensions/telegram/src/ingress.ts#L117-L119)
