Principle:Openclaw Openclaw Access Policy Configuration
| Knowledge Sources | |
|---|---|
| Domains | Messaging, Security, Configuration |
| Last Updated | 2026-02-06 12:00 GMT |
Overview
Access policy configuration defines the rules that govern who can interact with an OpenClaw bot through direct messages and group conversations, using DM gating policies, allowlists, and group-level restrictions.
Description
When a messaging channel is connected to the OpenClaw gateway, the operator must decide who is allowed to send messages to the bot. Without access controls, any user on the platform could interact with the bot, consuming resources and potentially accessing sensitive capabilities. OpenClaw addresses this through two orthogonal policy axes: DM policy (controlling direct message access) and group policy (controlling group conversation access).
The DM policy determines how the bot handles incoming direct messages from individual users. Four modes are available: pairing (the default, requiring users to complete a pairing handshake before interaction), allowlist (only users listed in allowFrom may interact), open (anyone may interact, but requires an explicit "*" wildcard in allowFrom as a safety measure), and disabled (the bot ignores all direct messages). These modes are enforced uniformly across all channel types through the DmPolicySchema.
The group policy controls whether the bot responds in group conversations. Three modes are available: allowlist (the default, only groups explicitly listed in the groups config are served), open (the bot responds in any group it is added to), and disabled (the bot ignores all group messages). The group policy works in conjunction with per-group configurations that can further restrict tool access, require mentions, and customize system prompts.
Usage
Access policies are configured at the channel account level within the OpenClaw config file. They are set during initial channel registration (via openclaw channels add) or modified later through direct config editing. Every channel account schema includes dmPolicy, allowFrom, groupPolicy, and groupAllowFrom fields that follow the shared policy schemas.
Theoretical Basis
The access policy model follows a deny-by-default, explicit-allow security posture:
- DM gating -- The default
dmPolicyis"pairing", which requires a cryptographic handshake before a user can interact. This is the most restrictive default and ensures no accidental exposure. - Group gating -- The default
groupPolicyis"allowlist", which means the bot will not respond in any group unless that group is explicitly listed in the config. - Open mode safety valve -- When
dmPolicyorgroupPolicyis set to"open", the schema requires thatallowFromincludes the wildcard"*". This serves as a deliberate opt-in confirmation that prevents accidental exposure from a typo or partial config change. - Layered override -- Per-group configs can override the account-level defaults, allowing fine-grained control. A group can have its own
requireMentionsetting, tool restrictions, and system prompt while inheriting the account's DM policy.
This layered approach ensures that operators can start with a locked-down configuration and progressively open access as needed, while the schema validation prevents unsafe states.