OpenClaw pairing, allowlists, and dmPolicy, explained
Who can talk to your agent is a setting — and the default is nobody you haven't approved. How pairing codes, allowlists, and group mention-gating work.
dmPolicy is OpenClaw’s answer to “who can talk to my agent?” — per channel, one of four modes. The default, pairing, challenges unknown senders with a short-lived code that you approve from the CLI; allowlist admits only pre-listed senders; open answers anyone (don’t); disabled ignores DMs entirely. In groups, the companion control is mention-gating — the agent only responds when addressed.
Why inbound access is THE security setting
Most security thinking about agents focuses on outbound powers — what the agent can do. Inbound access is the quieter half: anyone who can message your agent can attempt to steer it. Your bot’s Telegram handle is guessable public namespace; a WhatsApp number gets wrong-number texts; prompt injection is a thing strangers can try by simply talking. So OpenClaw’s design makes “who gets a conversation” an explicit, default-closed gate — and understanding it beats both the failure modes we see: frustration (“my own bot ignores me!”) and the reflexive fix that’s worse (open).
The four DM policies
pairing(default). An unknown sender’s first message earns a pairing code instead of an answer. You approve it operator-side:
Codes expire after an hour, and pending requests are capped — so strangers probing your agent leaves nothing standing. Right for: almost everyone.openclaw pairing list <channel> openclaw pairing approve <channel> <CODE>allowlist. Only senders inallowFrom(numeric user IDs on Telegram, phone numbers on WhatsApp) get through; unknowns are blocked without ceremony. Right for: a fixed, known set of humans — you and yours — with no approval workflow wanted.open. Anyone can message the agent (and OpenClaw makes you say so explicitly). The use cases are rare and deliberate — a public-facing helper with tightly capped tools. Anopenpolicy on a personal agent with real capabilities means strangers can try their luck against software that acts on your behalf.disabled. No DMs at all — for agents that should only exist in groups or the dashboard.
Groups: mention-gating
In group chats the question inverts — the agent can see everything, so the control is when it’s allowed to speak and act. The standard setting (requireMention: true, per group or as the "*" default) means the agent responds only when addressed. Leave it on: an agent that reacts to every message in a lively group is one prompt-injection-shaped message away from acting on something nobody asked it to.
The mental model
Pairing and allowlists are the front-door lock; they compose with the rest of the posture — a private Gateway, a dedicated machine, and the audit that checks all of it (inbound access policies are one of its named checks). On our pods these defaults arrive intact — pairing on, approval as part of onboarding — because the default-closed door is one of the best decisions OpenClaw made on your behalf.