OpenClaw pairing, allowlists, and dmPolicy, explained
Who can talk to your agent is a setting, and the default is nobody you haven't approved. How pairing codes, allowlists, and group mention-gating work.
dmPolicy is OpenClaw’s answer to “who can talk to my agent?”: per channel, one of four modes. The default, pairing, challenges unknown senders with a short-lived code that you approve from the CLI; allowlist admits only pre-listed senders; open answers anyone (don’t); disabled ignores DMs entirely. In groups, the companion control is mention-gating: the agent only responds when addressed.
Why inbound access is THE security setting
Most security thinking about agents focuses on outbound powers: what the agent can do. Inbound access is the quieter half: anyone who can message your agent can attempt to steer it. Your bot’s Telegram handle is guessable public namespace; a WhatsApp number gets wrong-number texts; prompt injection is a thing strangers can try by simply talking. So OpenClaw’s design makes “who gets a conversation” an explicit, default-closed gate, and understanding it beats both the failure modes we see: frustration (“my own bot ignores me!”) and the reflexive fix that’s worse (open).
The four DM policies
pairing(default). An unknown sender’s first message earns a pairing code instead of an answer. You approve it operator-side:Codes expire after an hour, and pending requests are capped, so strangers probing your agent leaves nothing standing. Right for: almost everyone.
Copiedopenclaw pairing list <channel> openclaw pairing approve <channel> <CODE>allowlist. Only senders inallowFrom(numeric user IDs on Telegram, phone numbers on WhatsApp) get through; unknowns are blocked without ceremony. Right for: a fixed, known set of humans (you and yours) with no approval workflow wanted.open. Anyone can message the agent (and OpenClaw makes you say so explicitly). The use cases are rare and deliberate: a public-facing helper with tightly capped tools. Anopenpolicy on a personal agent with real capabilities means strangers can try their luck against software that acts on your behalf.disabled. No DMs at all, for agents that should only exist in groups or the dashboard.
Groups: mention-gating
In group chats the question inverts: the agent can see everything, so the control is when it’s allowed to speak and act. The standard setting (requireMention: true, per group or as the "*" default) means the agent responds only when addressed. Leave it on: an agent that reacts to every message in a lively group is one prompt-injection-shaped message away from acting on something nobody asked it to.
The mental model
Pairing and allowlists are the front-door lock; they compose with the rest of the posture: a private Gateway, a dedicated machine, and the audit that checks all of it (inbound access policies are one of its named checks). Everpod’s OpenClaw pod arrives with these defaults intact, because the default-closed door is one of the best decisions OpenClaw made on your behalf.