u/Advanced_Pudding9228

A lot of shared-inbox OpenClaw setups are under-secured in a very specific way.

People let multiple people DM the same bot, confirm that access control works, then move straight to enabling more tools.

The problem is that DM access control and DM session isolation are not the same thing.

OpenClaw’s default session.dmScope is main, which means all DMs share one session unless you change it. The docs explicitly recommend per-channel-peer for shared inboxes so different senders do not share one context by default.

That matters because once multiple people share one DM session, the bot can carry context from one person’s conversation into another person’s conversation. Even when the sender is allowed, the session boundary is still wrong.

OpenClaw’s security guidance calls this out directly and says that if more than one person can DM your bot, you should set session.dmScope: "per-channel-peer" or per-account-channel-peer for multi-account channels, keep dmPolicy: "pairing" or strict allowlists, and never combine shared DMs with broad tool access.

The practical way to fix it is simple.
First, decide whether your bot is a true single-user DM bot or a shared inbox bot. If more than one person can message it, treat it as shared immediately.

Second, keep DM access narrow with pairing or strict allowFrom.

Third, set DM session isolation before you enable wider tool access.

In OpenClaw, the secure shared-inbox move is changing session.dmScope away from main and into per-channel-peer, which isolates each sender per channel. If you run multi-account channels, use per-account-channel-peer instead.

A good baseline config looks like this:

{
"session": {
"dmScope": "per-channel-peer"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "YOUR_TELEGRAM_BOT_TOKEN",
"dmPolicy": "pairing",
"allowFrom": ["123456789", "987654321"]
}
}
}

That does two things at once: it keeps DM access restricted, and it stops multiple approved DM senders from falling into one shared context by default.

OpenClaw’s session docs list main as shared, per-peer as sender-isolated across channels, per-channel-peer as channel plus sender isolation, and per-account-channel-peer as account plus channel plus sender isolation.

The docs mark per-channel-peer as the recommended setting.
The mistake is adding tools first and isolation later.

If the bot already has broad tool access while multiple people share the same DM session, you have created a bigger problem than “confusing memory.” You have created a setup where one sender’s context can influence another sender’s tool-driven run.

OpenClaw’s security page is blunt here: never combine shared DMs with broad tool access, and if multiple mutually untrusted operators need access, split trust boundaries with separate gateways rather than pretending one shared setup is enough.

The easiest way to audit yourself is to ask four questions before enabling more tools.

Can more than one person DM this bot?

Is session.dmScope still main?

Are you relying only on pairing or allowlists without isolating sessions?

Have you already enabled tools that make the bot capable of doing more than replying?

If the answers are yes, yes, yes, and yes, fix the DM scope first. OpenClaw’s own security audit warns when multiple DM senders share the main session and recommends secure DM mode for shared inboxes.

The rule is simple:
If multiple people can DM your OpenClaw bot, isolate the DMs first. Then add tools.
That order matters.

Scheduling is easy.
Posting is easy.
Even AI rewriting is becoming commoditised.

The difficult part is finding the signal before everyone else turns it into recycled content.

A Reddit thread where buyers keep repeating the same frustration.
A support pattern hidden across tickets.
A founder explaining why a workflow failed.
A niche comment section full of objections nobody captured yet.

That is usually where the strongest content angles actually start.

The problem is most workflows still handle that layer manually.

People screenshot posts.
Dump links into Notion.
Rewrite angles by hand.
Paste them into another AI tool.
Then finally send them into a scheduler.

That feels backwards.

The more interesting agent layer probably starts earlier:

Capture the signal.
Extract the angle.
Generate platform-specific drafts.
Queue them for review.
Track what shipped, failed, or performed.

Not blind AI spam.
Not “100 posts in one click.”

More like an operational content agent that turns raw market conversations into structured publishing workflows with human approval still in the loop.

OneClickPostFactory.com is already in beta.

Right now it pulls from Reddit and RSS-style sources, extracts content angles, drafts posts for multiple platforms, queues them for approval, and keeps publishing history logged.

The goal is not to replace judgement.

The goal is to remove the messy middle between:
“I found a useful market signal”
and
“This is ready to publish.”

If you are already doing that process manually, you’ll probably understand the problem immediately.

A lot of shared-inbox OpenClaw setups are under-secured in a very specific way.

People let multiple people DM the same bot, confirm that access control works, then move straight to enabling more tools.

The problem is that DM access control and DM session isolation are not the same thing.

OpenClaw’s default session.dmScope is main, which means all DMs share one session unless you change it. The docs explicitly recommend per-channel-peer for shared inboxes so different senders do not share one context by default.

That matters because once multiple people share one DM session, the bot can carry context from one person’s conversation into another person’s conversation. Even when the sender is allowed, the session boundary is still wrong.

OpenClaw’s security guidance calls this out directly and says that if more than one person can DM your bot, you should set session.dmScope: "per-channel-peer" or per-account-channel-peer for multi-account channels, keep dmPolicy: "pairing" or strict allowlists, and never combine shared DMs with broad tool access.

The practical way to fix it is simple.
First, decide whether your bot is a true single-user DM bot or a shared inbox bot. If more than one person can message it, treat it as shared immediately.

Second, keep DM access narrow with pairing or strict allowFrom.

Third, set DM session isolation before you enable wider tool access.

In OpenClaw, the secure shared-inbox move is changing session.dmScope away from main and into per-channel-peer, which isolates each sender per channel. If you run multi-account channels, use per-account-channel-peer instead.

A good baseline config looks like this:

{
"session": {
"dmScope": "per-channel-peer"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "YOUR_TELEGRAM_BOT_TOKEN",
"dmPolicy": "pairing",
"allowFrom": ["123456789", "987654321"]
}
}
}

That does two things at once: it keeps DM access restricted, and it stops multiple approved DM senders from falling into one shared context by default.

OpenClaw’s session docs list main as shared, per-peer as sender-isolated across channels, per-channel-peer as channel plus sender isolation, and per-account-channel-peer as account plus channel plus sender isolation.

The docs mark per-channel-peer as the recommended setting.
The mistake is adding tools first and isolation later.

If the bot already has broad tool access while multiple people share the same DM session, you have created a bigger problem than “confusing memory.” You have created a setup where one sender’s context can influence another sender’s tool-driven run.

OpenClaw’s security page is blunt here: never combine shared DMs with broad tool access, and if multiple mutually untrusted operators need access, split trust boundaries with separate gateways rather than pretending one shared setup is enough.

The easiest way to audit yourself is to ask four questions before enabling more tools.

Can more than one person DM this bot?

Is session.dmScope still main?

Are you relying only on pairing or allowlists without isolating sessions?

Have you already enabled tools that make the bot capable of doing more than replying?

If the answers are yes, yes, yes, and yes, fix the DM scope first. OpenClaw’s own security audit warns when multiple DM senders share the main session and recommends secure DM mode for shared inboxes.

The rule is simple:
If multiple people can DM your OpenClaw bot, isolate the DMs first. Then add tools.
That order matters.

Scheduling is easy.
Posting is easy.
Even AI rewriting is becoming commoditised.

The difficult part is finding the signal before everyone else turns it into recycled content.

A Reddit thread where buyers keep repeating the same frustration.
A support pattern hidden across tickets.
A founder explaining why a workflow failed.
A niche comment section full of objections nobody captured yet.

That is usually where the strongest content angles actually start.

The problem is most workflows still handle that layer manually.

People screenshot posts.
Dump links into Notion.
Rewrite angles by hand.
Paste them into another AI tool.
Then finally send them into a scheduler.

That feels backwards.

The more interesting agent layer probably starts earlier:

Capture the signal.
Extract the angle.
Generate platform-specific drafts.
Queue them for review.
Track what shipped, failed, or performed.

Not blind AI spam.
Not “100 posts in one click.”

More like an operational content agent that turns raw market conversations into structured publishing workflows with human approval still in the loop.

OneClickPostFactory.com is already in beta.

Right now it pulls from Reddit and RSS-style sources, extracts content angles, drafts posts for multiple platforms, queues them for approval, and keeps publishing history logged.

The goal is not to replace judgement.

The goal is to remove the messy middle between:
“I found a useful market signal”
and
“This is ready to publish.”

If you are already doing that process manually, you’ll probably understand the problem immediately.

A lot of OpenClaw users see sessionKey, session IDs, labels, or routed session handles and start treating them like security boundaries.

A session key tells OpenClaw where a conversation should land. It does not prove who is allowed to land there.

That distinction matters because once routing starts getting treated like authorization, people end up feeling safer than their setup actually is.

What session keys are

Session keys are routing selectors.
Their job is to steer turns into the correct conversation lane: one chat, one synthetic HTTP session, one ACP bridge session, one group thread, one delegated flow.

That is useful because it gives you continuity. The right memory stays attached to the right thread. The right transcript stays together. Follow-up turns land in the same lane instead of creating a new one every time.

That is the operational value of session keys. They help the system resume the right thread.

What session keys are not

Session keys are not authorization tokens.
Knowing or setting a session key does not mean a caller is trusted. It does not grant operator rights. It does not replace DM allowlists, group allowlists, pairing, token auth, password auth, trusted proxy identity, or approval policy.

This is the mistake worth calling out directly. People see a session identifier and start thinking, “this is my secure lane.”

In OpenClaw, it is only a lane. Security still comes from access control.

Where this goes wrong in practice

The common failure patterns are pretty consistent.
Someone reuses a known session key in HTTP and assumes the request is safe because it lands in the expected session.

Someone sees separate session histories for different chats and assumes those chats are separately authorized.

Someone uses session scoping for privacy and starts treating it like a permission boundary.
Someone shares one tool-enabled agent with several people and assumes separate sessions make that arrangement safe enough.

What session separation can do is reduce context bleed. What it cannot do is turn a shared agent into per-user host authorization.
That is a different control entirely.

How to use this knowledge properly

Once you understand session keys as routing only, they become easier to use correctly.
Use session keys to control continuity.
Use them when you want a client, bridge, or integration to resume the same conversation.
Use them when you want predictable transcript placement.

Use them when one workflow needs to stay in one lane and another workflow needs to stay in another lane.

That is the real benefit: cleaner routing, cleaner memory, and cleaner operational behaviour.
Just do not expect session keys to do access-control work they were never designed to do.

What actually provides security

If you want to know whether a setup is secure, the real controls are elsewhere:

gateway auth
DM policy
group policy
allowlists
trusted proxy identity
tool permissions
approval policy
separate gateways or hosts when trust boundaries differ and that is the layer where “who is allowed to do what” gets decided.

Session routing only answers one question: where should this turn go?

A practical check for your own setup

A useful self-check is this:
If someone guessed or reused a valid session key, what would actually stop them?
If the honest answer is “the session key itself,” the security model is wrong.

The answer should be one of your real access controls: token auth, password auth, trusted proxy auth, pairing, DM allowlist, group allowlist, or a stricter gateway boundary.

What to change

Do not use session scoping as a substitute for access control.

Keep using session keys for routing and continuity.
Move your security thinking back to the controls that actually enforce trust: auth, allowlists, tool boundaries, and gateway separation.

If multiple users can steer one tool-enabled agent, separate sessions should not be mistaken for tenant isolation.

What you built is routing. That is useful, but it is not the same thing as authorization.

The rule to remember

Session keys decide where a turn goes.
Authorization decides whether that turn should have been allowed at all.
OpenClaw setups get much easier to reason about once those two jobs stop being mixed together.

A lot of OpenClaw users see sessionKey, session IDs, labels, or routed session handles and start treating them like security boundaries.

A session key tells OpenClaw where a conversation should land. It does not prove who is allowed to land there.

That distinction matters because once routing starts getting treated like authorization, people end up feeling safer than their setup actually is.

What session keys are

Session keys are routing selectors.
Their job is to steer turns into the correct conversation lane: one chat, one synthetic HTTP session, one ACP bridge session, one group thread, one delegated flow.

That is useful because it gives you continuity. The right memory stays attached to the right thread. The right transcript stays together. Follow-up turns land in the same lane instead of creating a new one every time.

That is the operational value of session keys. They help the system resume the right thread.

What session keys are not
Session keys are not authorization tokens.
Knowing or setting a session key does not mean a caller is trusted. It does not grant operator rights. It does not replace DM allowlists, group allowlists, pairing, token auth, password auth, trusted proxy identity, or approval policy.

This is the mistake worth calling out directly. People see a session identifier and start thinking, “this is my secure lane.”

In OpenClaw, it is only a lane. Security still comes from access control.

Where this goes wrong in practice

The common failure patterns are pretty consistent.
Someone reuses a known session key in HTTP and assumes the request is safe because it lands in the expected session.

Someone sees separate session histories for different chats and assumes those chats are separately authorized.

Someone uses session scoping for privacy and starts treating it like a permission boundary.
Someone shares one tool-enabled agent with several people and assumes separate sessions make that arrangement safe enough.

What session separation can do is reduce context bleed. What it cannot do is turn a shared agent into per-user host authorization.
That is a different control entirely.

How to use this knowledge properly

Once you understand session keys as routing only, they become easier to use correctly.
Use session keys to control continuity.
Use them when you want a client, bridge, or integration to resume the same conversation.
Use them when you want predictable transcript placement.

Use them when one workflow needs to stay in one lane and another workflow needs to stay in another lane.

That is the real benefit: cleaner routing, cleaner memory, and cleaner operational behaviour.
Just do not expect session keys to do access-control work they were never designed to do.

What actually provides security

If you want to know whether a setup is secure, the real controls are elsewhere:

gateway auth
DM policy
group policy
allowlists
trusted proxy identity
tool permissions
approval policy
separate gateways or hosts when trust boundaries differ and that is the layer where “who is allowed to do what” gets decided.

Session routing only answers one question: where should this turn go?

A practical check for your own setup

A useful self-check is this:
If someone guessed or reused a valid session key, what would actually stop them?
If the honest answer is “the session key itself,” the security model is wrong.

The answer should be one of your real access controls: token auth, password auth, trusted proxy auth, pairing, DM allowlist, group allowlist, or a stricter gateway boundary.

What to change
Do not use session scoping as a substitute for access control.

Keep using session keys for routing and continuity.
Move your security thinking back to the controls that actually enforce trust: auth, allowlists, tool boundaries, and gateway separation.

If multiple users can steer one tool-enabled agent, separate sessions should not be mistaken for tenant isolation.

What you built is routing. That is useful, but it is not the same thing as authorization.

The rule to remember

Session keys decide where a turn goes.
Authorization decides whether that turn should have been allowed at all.
OpenClaw setups get much easier to reason about once those two jobs stop being mixed together.

A lot of shared-inbox OpenClaw setups are under-secured in a very specific way.

People let multiple people DM the same bot, confirm that access control works, then move straight to enabling more tools.

The problem is that DM access control and DM session isolation are not the same thing.

OpenClaw’s default session.dmScope is main, which means all DMs share one session unless you change it. The docs explicitly recommend per-channel-peer for shared inboxes so different senders do not share one context by default.

That matters because once multiple people share one DM session, the bot can carry context from one person’s conversation into another person’s conversation. Even when the sender is allowed, the session boundary is still wrong.

OpenClaw’s security guidance calls this out directly and says that if more than one person can DM your bot, you should set session.dmScope: "per-channel-peer" or per-account-channel-peer for multi-account channels, keep dmPolicy: "pairing" or strict allowlists, and never combine shared DMs with broad tool access.

The practical way to fix it is simple.
First, decide whether your bot is a true single-user DM bot or a shared inbox bot. If more than one person can message it, treat it as shared immediately.

Second, keep DM access narrow with pairing or strict allowFrom.

Third, set DM session isolation before you enable wider tool access.

In OpenClaw, the secure shared-inbox move is changing session.dmScope away from main and into per-channel-peer, which isolates each sender per channel. If you run multi-account channels, use per-account-channel-peer instead.

A good baseline config looks like this:

{
"session": {
"dmScope": "per-channel-peer"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "YOUR\_TELEGRAM\_BOT\_TOKEN",
"dmPolicy": "pairing",
"allowFrom": \["123456789", "987654321"\]
}
}
}

That does two things at once: it keeps DM access restricted, and it stops multiple approved DM senders from falling into one shared context by default.

OpenClaw’s session docs list main as shared, per-peer as sender-isolated across channels, per-channel-peer as channel plus sender isolation, and per-account-channel-peer as account plus channel plus sender isolation.

The docs mark per-channel-peer as the recommended setting.
The mistake is adding tools first and isolation later.

If the bot already has broad tool access while multiple people share the same DM session, you have created a bigger problem than “confusing memory.” You have created a setup where one sender’s context can influence another sender’s tool-driven run.

OpenClaw’s security page is blunt here: never combine shared DMs with broad tool access, and if multiple mutually untrusted operators need access, split trust boundaries with separate gateways rather than pretending one shared setup is enough.

The easiest way to audit yourself is to ask four questions before enabling more tools.

Can more than one person DM this bot?

Is session.dmScope still main?

Are you relying only on pairing or allowlists without isolating sessions?

Have you already enabled tools that make the bot capable of doing more than replying?

If the answers are yes, yes, yes, and yes, fix the DM scope first. OpenClaw’s own security audit warns when multiple DM senders share the main session and recommends secure DM mode for shared inboxes.

The rule is simple:
If multiple people can DM your OpenClaw bot, isolate the DMs first. Then add tools.
That order matters.

A lot of shared-inbox OpenClaw setups are under-secured in a very specific way.

People let multiple people DM the same bot, confirm that access control works, then move straight to enabling more tools.

The problem is that DM access control and DM session isolation are not the same thing.

OpenClaw’s default session.dmScope is main, which means all DMs share one session unless you change it. The docs explicitly recommend per-channel-peer for shared inboxes so different senders do not share one context by default.

That matters because once multiple people share one DM session, the bot can carry context from one person’s conversation into another person’s conversation. Even when the sender is allowed, the session boundary is still wrong.

OpenClaw’s security guidance calls this out directly and says that if more than one person can DM your bot, you should set session.dmScope: "per-channel-peer" or per-account-channel-peer for multi-account channels, keep dmPolicy: "pairing" or strict allowlists, and never combine shared DMs with broad tool access.

The practical way to fix it is simple.
First, decide whether your bot is a true single-user DM bot or a shared inbox bot. If more than one person can message it, treat it as shared immediately.

Second, keep DM access narrow with pairing or strict allowFrom.

Third, set DM session isolation before you enable wider tool access.

In OpenClaw, the secure shared-inbox move is changing session.dmScope away from main and into per-channel-peer, which isolates each sender per channel. If you run multi-account channels, use per-account-channel-peer instead.

A good baseline config looks like this:

{
"session": {
"dmScope": "per-channel-peer"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "YOUR_TELEGRAM_BOT_TOKEN",
"dmPolicy": "pairing",
"allowFrom": ["123456789", "987654321"]
}
}
}

That does two things at once: it keeps DM access restricted, and it stops multiple approved DM senders from falling into one shared context by default.

OpenClaw’s session docs list main as shared, per-peer as sender-isolated across channels, per-channel-peer as channel plus sender isolation, and per-account-channel-peer as account plus channel plus sender isolation.

The docs mark per-channel-peer as the recommended setting.
The mistake is adding tools first and isolation later.

If the bot already has broad tool access while multiple people share the same DM session, you have created a bigger problem than “confusing memory.” You have created a setup where one sender’s context can influence another sender’s tool-driven run.

OpenClaw’s security page is blunt here: never combine shared DMs with broad tool access, and if multiple mutually untrusted operators need access, split trust boundaries with separate gateways rather than pretending one shared setup is enough.

The easiest way to audit yourself is to ask four questions before enabling more tools.

Can more than one person DM this bot?

Is session.dmScope still main?

Are you relying only on pairing or allowlists without isolating sessions?

Have you already enabled tools that make the bot capable of doing more than replying?

If the answers are yes, yes, yes, and yes, fix the DM scope first. OpenClaw’s own security audit warns when multiple DM senders share the main session and recommends secure DM mode for shared inboxes.

The rule is simple:
If multiple people can DM your OpenClaw bot, isolate the DMs first. Then add tools.
That order matters.

A lot of OpenClaw users think the hard part is getting the bot running.

It is not.

The harder part is deciding what the bot is allowed to do, who is allowed to reach it, and how much damage a bad message can cause once it gets through. OpenClaw’s own security docs push a hardened baseline first: local-only Gateway bind, token auth, per-peer DM isolation, deny runtime/fs/automation tool groups by default, exec locked down, elevated mode off, and mention-gated groups.

The practical mistake is starting from “make it work” config and calling that secure because it is self-hosted. Self-hosting only changes who owns the box. It does not automatically narrow access, isolate sessions, or reduce tool blast radius. OpenClaw treats one Gateway as one trusted operator boundary, and the docs are explicit that you should start closed and widen later.

The easiest place to get this wrong is the Gateway itself. If your bind is not local-only and your auth is not explicit, you are already looser than the hardened baseline. The docs’ baseline starts with gateway.mode: "local", bind: "loopback", and auth.mode: "token" for a reason: expose later only when you understand the boundary you are widening.

The next thing OpenClaw users underestimate is DM session sharing. If more than one person can DM the bot and you keep a broad shared DM scope, you create context bleed before you even get to tools. The security docs explicitly call out session.dmScope: "per-channel-peer" as the right default for shared inboxes, and the quick rule is blunt: never combine shared DMs with broad tool access.

Then comes the real blast radius: tools. Most people think “who can message the bot?” before they think “what authority does a successful message inherit?” The hardened baseline keeps tools.profile: "messaging" and denies group:automation, group:runtime, group:fs, plus session-spawn/session-send surfaces by default. That means the bot can talk before it can automate, run code, touch files, or fan out into more agent control surfaces. That is the right order.

exec is where a lot of people get overconfident. The hardened baseline sets exec.security: "deny" and ask: "always" with elevated mode disabled. That is the lesson: do not give your agent shell power first and try to “be careful” later. Start from denial, then re-enable only the minimum you can justify.

Groups need the same mindset. An allowed room should not mean the bot wakes on everything. OpenClaw’s hardened baseline uses mention-gated groups, and the docs are clear that group checks run through allowlist policy first and activation second. In practice that means groups should stay opt-in and mention-triggered unless you have a strong reason to loosen them.

If you want a practical starting point, this is the shape to copy first and widen later:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": {
"mode": "token",
"token": "replace-with-long-random-token"
}
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \\\[
"group:automation",
"group:runtime",
"group:fs",
"sessions\\\_spawn",
"sessions\\\_send"
\\\],
"fs": {
"workspaceOnly": true
},
"exec": {
"security": "deny",
"ask": "always"
},
"elevated": {
"enabled": false
}
},
"channels": {
"whatsapp": {
"dmPolicy": "pairing",
"groups": {
"\\\*": {
"requireMention": true
}
}
}
}
}

That is the documented hardened baseline. The point is to begin with a bot that can reply safely, then deliberately add capability only when you understand the consequence of each new surface.

The useful way to think about this is simple.
Before you widen anything, ask four questions.

Can the Gateway be reached from more places than it needs to be?

Can one person’s DM context leak into another person’s session?

Can an ordinary message inherit tool authority that is broader than intended?

Can a room trigger the bot too easily?

If the answer to any of those is yes, the fix is probably not “more prompt engineering.” It is config hardening. OpenClaw already gives you the surfaces. Use them.

Best rule for OpenClaw users:
Start with the hardened baseline. Make the bot useful first. Make it powerful second.

A lot of OpenClaw users think the hard part is getting the bot running.

It is not.

The harder part is deciding what the bot is allowed to do, who is allowed to reach it, and how much damage a bad message can cause once it gets through. OpenClaw’s own security docs push a hardened baseline first: local-only Gateway bind, token auth, per-peer DM isolation, deny runtime/fs/automation tool groups by default, exec locked down, elevated mode off, and mention-gated groups.

The practical mistake is starting from “make it work” config and calling that secure because it is self-hosted. Self-hosting only changes who owns the box. It does not automatically narrow access, isolate sessions, or reduce tool blast radius. OpenClaw treats one Gateway as one trusted operator boundary, and the docs are explicit that you should start closed and widen later.

The easiest place to get this wrong is the Gateway itself. If your bind is not local-only and your auth is not explicit, you are already looser than the hardened baseline. The docs’ baseline starts with gateway.mode: "local", bind: "loopback", and auth.mode: "token" for a reason: expose later only when you understand the boundary you are widening.

The next thing OpenClaw users underestimate is DM session sharing. If more than one person can DM the bot and you keep a broad shared DM scope, you create context bleed before you even get to tools. The security docs explicitly call out session.dmScope: "per-channel-peer" as the right default for shared inboxes, and the quick rule is blunt: never combine shared DMs with broad tool access.

Then comes the real blast radius: tools. Most people think “who can message the bot?” before they think “what authority does a successful message inherit?” The hardened baseline keeps tools.profile: "messaging" and denies group:automation, group:runtime, group:fs, plus session-spawn/session-send surfaces by default. That means the bot can talk before it can automate, run code, touch files, or fan out into more agent control surfaces. That is the right order.

exec is where a lot of people get overconfident. The hardened baseline sets exec.security: "deny" and ask: "always" with elevated mode disabled. That is the lesson: do not give your agent shell power first and try to “be careful” later. Start from denial, then re-enable only the minimum you can justify.

Groups need the same mindset. An allowed room should not mean the bot wakes on everything. OpenClaw’s hardened baseline uses mention-gated groups, and the docs are clear that group checks run through allowlist policy first and activation second. In practice that means groups should stay opt-in and mention-triggered unless you have a strong reason to loosen them.

If you want a practical starting point, this is the shape to copy first and widen later:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": {
"mode": "token",
"token": "replace-with-long-random-token"
}
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \\\[
"group:automation",
"group:runtime",
"group:fs",
"sessions\\\_spawn",
"sessions\\\_send"
\\\],
"fs": {
"workspaceOnly": true
},
"exec": {
"security": "deny",
"ask": "always"
},
"elevated": {
"enabled": false
}
},
"channels": {
"whatsapp": {
"dmPolicy": "pairing",
"groups": {
"\\\*": {
"requireMention": true
}
}
}
}
}

That is the documented hardened baseline. The point is to begin with a bot that can reply safely, then deliberately add capability only when you understand the consequence of each new surface.

The useful way to think about this is simple.
Before you widen anything, ask four questions.

Can the Gateway be reached from more places than it needs to be?

Can one person’s DM context leak into another person’s session?

Can an ordinary message inherit tool authority that is broader than intended?

Can a room trigger the bot too easily?

If the answer to any of those is yes, the fix is probably not “more prompt engineering.” It is config hardening. OpenClaw already gives you the surfaces. Use them.

Best rule for OpenClaw users:
Start with the hardened baseline. Make the bot useful first. Make it powerful second.

A lot of OpenClaw users think the hard part is getting the bot running.

It is not.

The harder part is deciding what the bot is allowed to do, who is allowed to reach it, and how much damage a bad message can cause once it gets through. OpenClaw’s own security docs push a hardened baseline first: local-only Gateway bind, token auth, per-peer DM isolation, deny runtime/fs/automation tool groups by default, exec locked down, elevated mode off, and mention-gated groups.

The practical mistake is starting from “make it work” config and calling that secure because it is self-hosted. Self-hosting only changes who owns the box. It does not automatically narrow access, isolate sessions, or reduce tool blast radius. OpenClaw treats one Gateway as one trusted operator boundary, and the docs are explicit that you should start closed and widen later.

The easiest place to get this wrong is the Gateway itself. If your bind is not local-only and your auth is not explicit, you are already looser than the hardened baseline. The docs’ baseline starts with gateway.mode: "local", bind: "loopback", and auth.mode: "token" for a reason: expose later only when you understand the boundary you are widening.

The next thing OpenClaw users underestimate is DM session sharing. If more than one person can DM the bot and you keep a broad shared DM scope, you create context bleed before you even get to tools. The security docs explicitly call out session.dmScope: "per-channel-peer" as the right default for shared inboxes, and the quick rule is blunt: never combine shared DMs with broad tool access.

Then comes the real blast radius: tools. Most people think “who can message the bot?” before they think “what authority does a successful message inherit?” The hardened baseline keeps tools.profile: "messaging" and denies group:automation, group:runtime, group:fs, plus session-spawn/session-send surfaces by default. That means the bot can talk before it can automate, run code, touch files, or fan out into more agent control surfaces. That is the right order.

exec is where a lot of people get overconfident. The hardened baseline sets exec.security: "deny" and ask: "always" with elevated mode disabled. That is the lesson: do not give your agent shell power first and try to “be careful” later. Start from denial, then re-enable only the minimum you can justify.

Groups need the same mindset. An allowed room should not mean the bot wakes on everything. OpenClaw’s hardened baseline uses mention-gated groups, and the docs are clear that group checks run through allowlist policy first and activation second. In practice that means groups should stay opt-in and mention-triggered unless you have a strong reason to loosen them.

If you want a practical starting point, this is the shape to copy first and widen later:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": {
"mode": "token",
"token": "replace-with-long-random-token"
}
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"group:automation",
"group:runtime",
"group:fs",
"sessions\_spawn",
"sessions\_send"
\],
"fs": {
"workspaceOnly": true
},
"exec": {
"security": "deny",
"ask": "always"
},
"elevated": {
"enabled": false
}
},
"channels": {
"whatsapp": {
"dmPolicy": "pairing",
"groups": {
"\*": {
"requireMention": true
}
}
}
}
}

That is the documented hardened baseline. The point is to begin with a bot that can reply safely, then deliberately add capability only when you understand the consequence of each new surface.

The useful way to think about this is simple.
Before you widen anything, ask four questions.

Can the Gateway be reached from more places than it needs to be?

Can one person’s DM context leak into another person’s session?

Can an ordinary message inherit tool authority that is broader than intended?

Can a room trigger the bot too easily?

If the answer to any of those is yes, the fix is probably not “more prompt engineering.” It is config hardening. OpenClaw already gives you the surfaces. Use them.

Best rule for OpenClaw users:
Start with the hardened baseline. Make the bot useful first. Make it powerful second.

A lot of OpenClaw users think the hard part is getting the bot running.

It is not.

The harder part is deciding what the bot is allowed to do, who is allowed to reach it, and how much damage a bad message can cause once it gets through. OpenClaw’s own security docs push a hardened baseline first: local-only Gateway bind, token auth, per-peer DM isolation, deny runtime/fs/automation tool groups by default, exec locked down, elevated mode off, and mention-gated groups.

The practical mistake is starting from “make it work” config and calling that secure because it is self-hosted. Self-hosting only changes who owns the box. It does not automatically narrow access, isolate sessions, or reduce tool blast radius. OpenClaw treats one Gateway as one trusted operator boundary, and the docs are explicit that you should start closed and widen later.

The easiest place to get this wrong is the Gateway itself. If your bind is not local-only and your auth is not explicit, you are already looser than the hardened baseline. The docs’ baseline starts with gateway.mode: "local", bind: "loopback", and auth.mode: "token" for a reason: expose later only when you understand the boundary you are widening.

The next thing OpenClaw users underestimate is DM session sharing. If more than one person can DM the bot and you keep a broad shared DM scope, you create context bleed before you even get to tools. The security docs explicitly call out session.dmScope: "per-channel-peer" as the right default for shared inboxes, and the quick rule is blunt: never combine shared DMs with broad tool access.

Then comes the real blast radius: tools. Most people think “who can message the bot?” before they think “what authority does a successful message inherit?” The hardened baseline keeps tools.profile: "messaging" and denies group:automation, group:runtime, group:fs, plus session-spawn/session-send surfaces by default. That means the bot can talk before it can automate, run code, touch files, or fan out into more agent control surfaces. That is the right order.

exec is where a lot of people get overconfident. The hardened baseline sets exec.security: "deny" and ask: "always" with elevated mode disabled. That is the lesson: do not give your agent shell power first and try to “be careful” later. Start from denial, then re-enable only the minimum you can justify.

Groups need the same mindset. An allowed room should not mean the bot wakes on everything. OpenClaw’s hardened baseline uses mention-gated groups, and the docs are clear that group checks run through allowlist policy first and activation second. In practice that means groups should stay opt-in and mention-triggered unless you have a strong reason to loosen them.

If you want a practical starting point, this is the shape to copy first and widen later:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": {
"mode": "token",
"token": "replace-with-long-random-token"
}
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": [
"group:automation",
"group:runtime",
"group:fs",
"sessions_spawn",
"sessions_send"
],
"fs": {
"workspaceOnly": true
},
"exec": {
"security": "deny",
"ask": "always"
},
"elevated": {
"enabled": false
}
},
"channels": {
"whatsapp": {
"dmPolicy": "pairing",
"groups": {
"*": {
"requireMention": true
}
}
}
}
}

That is the documented hardened baseline. The point is to begin with a bot that can reply safely, then deliberately add capability only when you understand the consequence of each new surface.

The useful way to think about this is simple.
Before you widen anything, ask four questions.

Can the Gateway be reached from more places than it needs to be?

Can one person’s DM context leak into another person’s session?

Can an ordinary message inherit tool authority that is broader than intended?

Can a room trigger the bot too easily?

If the answer to any of those is yes, the fix is probably not “more prompt engineering.” It is config hardening. OpenClaw already gives you the surfaces. Use them.

Best rule for OpenClaw users:
Start with the hardened baseline. Make the bot useful first. Make it powerful second.

Scheduling is easy.
Posting is easy.
Even AI rewriting is becoming commoditised.

The difficult part is finding the signal before everyone else turns it into recycled content.

A Reddit thread where buyers keep repeating the same frustration.
A support pattern hidden across tickets.
A founder explaining why a workflow failed.
A niche comment section full of objections nobody captured yet.

That is usually where the strongest content angles actually start.

The problem is most workflows still handle that layer manually.

People screenshot posts.
Dump links into Notion.
Rewrite angles by hand.
Paste them into another AI tool.
Then finally send them into a scheduler.

That feels backwards.

The more interesting agent layer probably starts earlier:

Capture the signal.
Extract the angle.
Generate platform-specific drafts.
Queue them for review.
Track what shipped, failed, or performed.

Not blind AI spam.
Not “100 posts in one click.”

More like an operational content agent that turns raw market conversations into structured publishing workflows with human approval still in the loop.

OneClickPostFactory.com is already in beta.

Right now it pulls from Reddit and RSS-style sources, extracts content angles, drafts posts for multiple platforms, queues them for approval, and keeps publishing history logged.

The goal is not to replace judgement.

The goal is to remove the messy middle between:
“I found a useful market signal”
and
“This is ready to publish.”

If you are already doing that process manually, you’ll probably understand the problem immediately.

A lot of OpenClaw users secure who can message the bot and never audit what those messages can make the bot do, and that is the bigger risk.

If multiple untrusted users can message one tool-enabled agent, OpenClaw says to treat them as sharing the same delegated tool authority for that agent. That is the security line to pay attention to first.

Here is the practical way to harden it.

1. Audit the tool surface before you audit the contact list

Check which tools the agent can actually use.

At minimum, inspect: tools.profile, tools.exec.security, tools.exec.ask, tools.exec.host, tools.elevated.enabled, tools.fs.workspaceOnly

OpenClaw’s policy docs call these out directly because they decide whether the agent can run broad exec, where it can run it, whether it must ask first, whether elevated mode is possible, and whether filesystem access is locked to the workspace.

2. Put shared bots on a smaller tool profile

If a bot is reachable by more people, reduce its capability envelope.

Use tool profiles and allow/deny policy instead of giving every shared agent the same coding or operator tool access as your private bot. OpenClaw’s policy layer supports profile-based control and explicit allow/deny posture for exec, fs, elevated, and related tools.

3. Lock exec down first

If you are not actively using shell execution, set it to deny.

If you do need it, use an allowlist security mode, require ask, and keep host routing constrained to sandbox where possible. OpenClaw’s policy docs explicitly support deny or allowlist exec security, always ask posture, and sandbox host routing.

4. Keep elevated mode off unless there is a very specific need

Do not leave elevated available on a shared or semi-shared agent.

OpenClaw documents elevated as a separate gate from sandbox and tool policy, and /elevated full can skip exec approvals for that session. That is not something you want floating around on a bot multiple people can reach.

5. Use the managed browser, not your personal browser

If the agent needs browser access, keep it inside the OpenClaw-managed browser profile.

The docs are explicit that the managed browser is isolated from your personal browser and controlled through a loopback-only service inside the Gateway. That gives you a smaller blast radius than letting the agent operate against your normal browser context.

6. Isolate DM sessions if more than one person can reach the bot

If multiple people can DM the same bot, do not leave them on the shared main DM session.

OpenClaw’s security audit warns about this and recommends session.dmScope="per-channel-peer" or per-account-channel-peer for shared inboxes. The session docs also note that main means all DMs share one session.

7. Split personal bots from shared bots

Do not use one bot for private operator work and for broader shared access.

OpenClaw’s security posture is one trust boundary per gateway. If you need adversarial or meaningfully different trust boundaries, split them with separate gateways and ideally separate OS users or hosts.

8. Run the audit before and after you widen exposure

Before adding more users, more groups, remote access, or proxy exposure, run:

openclaw security audit
openclaw security audit --deep

The exposure runbook is blunt: only expose the Gateway after you can explain who can reach it, how they authenticate, which agents they can trigger, and which tools those agents can use.

9. Use this rule for every shared agent

More reachable bot
less tool authority

Not the other way around.

That one rule will prevent a lot of bad OpenClaw setups.

Quick checklist

Can this bot run exec at all?
Does exec require ask?
Is exec sandboxed or broadly routed?
Is elevated disabled?
Is fs locked to workspace only?
Is the browser isolated?
Are multiple DM senders sharing one session?
Should this bot be split into a separate gateway?

That is the real delegated tool authority check.

Because the important question is not just who can message the bot.

It is what that message can cause the bot to do.

One gateway is one trust boundary.
A lot of OpenClaw users understand the words around security but still miss the operational meaning.

If you run one shared gateway and let multiple untrusted people talk to one tool-enabled agent, OpenClaw does not treat that as a safe multi-tenant boundary.

The docs are explicit: one gateway is one trusted operator boundary, and if you need mixed-trust or adversarial-user isolation, you should split that into separate gateways, ideally with separate OS users or separate hosts.

That matters because the real risk is not just “someone can message the bot.”
The real risk is delegated tool authority.
If several untrusted people can message the same tool-enabled agent, they are effectively steering the same permission set.

OpenClaw calls this out directly:

any allowed sender can induce tool calls within that agent’s policy, and if that shared agent has sensitive files, credentials, browser state, or powerful tools attached, every allowed sender is now operating inside that blast radius.

Here is what the bad pattern looks like:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "one-shared-token" }
},
"tools": {
"profile": "default"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "TEAM\_BOT\_TOKEN",
"dmPolicy": "open",
"groupPolicy": "open"
}
}
}

One runtime, one token, one tool surface, many people.
That is exactly the kind of setup where people think sessions or prompt rules will save them later.
They will not.

OpenClaw is also clear that session identifiers are routing selectors, not authorization tokens.

Per-user session or memory isolation does not turn one shared agent into per-user host authorization.
If you want the boundary to be real, split the boundary in config and in runtime.

A personal boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "alice-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"group:automation",
"group:runtime",
"group:fs",
"sessions\_spawn",
"sessions\_send"
\],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "ALICE\_BOT\_TOKEN",
"dmPolicy": "pairing",
"allowFrom": \["111111111"\],
"groupPolicy": "allowlist",
"groupAllowFrom": \["111111111"\],
"groups": {
"-1001111111111": { "requireMention": true }
}
}
}
}

That follows OpenClaw’s hardened direction:

local-only bind
token auth
per-peer DM isolation
narrow tool access
exec denied or approval-gated
elevated mode off
mention-gated groups

A company boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "team-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"sessions\_spawn",
"sessions\_send"
\],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"slack": {
"enabled": true,
"dmPolicy": "allowlist",
"allowFrom": \["U123", "U456"\],
"groupPolicy": "allowlist",
"groupAllowFrom": \["U123", "U456"\],
"groups": {
"C0123456789": { "requireMention": true }
}
}
}
}

That kind of shared setup only makes sense when the users are actually inside the same trust boundary and the runtime is kept strictly business-scoped.

So the practical check is simple.
If Alice and a contractor should not have the same authority, they should not be talking to the same powerful OpenClaw agent.

If personal and company data should not mix, they should not share the same gateway runtime.

If you need a true split, split the gateway, split the credentials, and split the host context together.

Separate sessions help privacy.

Separate gateways create the boundary.

One gateway is one trust boundary.
A lot of OpenClaw users understand the words around security but still miss the operational meaning.

If you run one shared gateway and let multiple untrusted people talk to one tool-enabled agent, OpenClaw does not treat that as a safe multi-tenant boundary.

The docs are explicit: one gateway is one trusted operator boundary, and if you need mixed-trust or adversarial-user isolation, you should split that into separate gateways, ideally with separate OS users or separate hosts.

That matters because the real risk is not just “someone can message the bot.”
The real risk is delegated tool authority.
If several untrusted people can message the same tool-enabled agent, they are effectively steering the same permission set.

OpenClaw calls this out directly:

any allowed sender can induce tool calls within that agent’s policy, and if that shared agent has sensitive files, credentials, browser state, or powerful tools attached, every allowed sender is now operating inside that blast radius.

Here is what the bad pattern looks like:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "one-shared-token" }
},
"tools": {
"profile": "default"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "TEAM\_BOT\_TOKEN",
"dmPolicy": "open",
"groupPolicy": "open"
}
}
}

One runtime, one token, one tool surface, many people.
That is exactly the kind of setup where people think sessions or prompt rules will save them later.
They will not.

OpenClaw is also clear that session identifiers are routing selectors, not authorization tokens.

Per-user session or memory isolation does not turn one shared agent into per-user host authorization.
If you want the boundary to be real, split the boundary in config and in runtime.

A personal boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "alice-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"group:automation",
"group:runtime",
"group:fs",
"sessions\_spawn",
"sessions\_send"
\],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "ALICE\_BOT\_TOKEN",
"dmPolicy": "pairing",
"allowFrom": \["111111111"\],
"groupPolicy": "allowlist",
"groupAllowFrom": \["111111111"\],
"groups": {
"-1001111111111": { "requireMention": true }
}
}
}
}

That follows OpenClaw’s hardened direction:

local-only bind
token auth
per-peer DM isolation
narrow tool access
exec denied or approval-gated
elevated mode off
mention-gated groups

A company boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "team-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"sessions\_spawn",
"sessions\_send"
\],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"slack": {
"enabled": true,
"dmPolicy": "allowlist",
"allowFrom": \["U123", "U456"\],
"groupPolicy": "allowlist",
"groupAllowFrom": \["U123", "U456"\],
"groups": {
"C0123456789": { "requireMention": true }
}
}
}
}

That kind of shared setup only makes sense when the users are actually inside the same trust boundary and the runtime is kept strictly business-scoped.

So the practical check is simple.
If Alice and a contractor should not have the same authority, they should not be talking to the same powerful OpenClaw agent.

If personal and company data should not mix, they should not share the same gateway runtime.

If you need a true split, split the gateway, split the credentials, and split the host context together.

Separate sessions help privacy.

Separate gateways create the boundary.

One gateway is one trust boundary.
A lot of OpenClaw users understand the words around security but still miss the operational meaning.

If you run one shared gateway and let multiple untrusted people talk to one tool-enabled agent, OpenClaw does not treat that as a safe multi-tenant boundary.

The docs are explicit: one gateway is one trusted operator boundary, and if you need mixed-trust or adversarial-user isolation, you should split that into separate gateways, ideally with separate OS users or separate hosts.

That matters because the real risk is not just “someone can message the bot.”
The real risk is delegated tool authority.
If several untrusted people can message the same tool-enabled agent, they are effectively steering the same permission set.

OpenClaw calls this out directly:

any allowed sender can induce tool calls within that agent’s policy, and if that shared agent has sensitive files, credentials, browser state, or powerful tools attached, every allowed sender is now operating inside that blast radius.

Here is what the bad pattern looks like:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "one-shared-token" }
},
"tools": {
"profile": "default"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "TEAM\_BOT\_TOKEN",
"dmPolicy": "open",
"groupPolicy": "open"
}
}
}

One runtime, one token, one tool surface, many people.
That is exactly the kind of setup where people think sessions or prompt rules will save them later.
They will not.

OpenClaw is also clear that session identifiers are routing selectors, not authorization tokens.

Per-user session or memory isolation does not turn one shared agent into per-user host authorization.
If you want the boundary to be real, split the boundary in config and in runtime.

A personal boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "alice-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"group:automation",
"group:runtime",
"group:fs",
"sessions\_spawn",
"sessions\_send"
\],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "ALICE\_BOT\_TOKEN",
"dmPolicy": "pairing",
"allowFrom": \["111111111"\],
"groupPolicy": "allowlist",
"groupAllowFrom": \["111111111"\],
"groups": {
"-1001111111111": { "requireMention": true }
}
}
}
}

That follows OpenClaw’s hardened direction:

local-only bind
token auth
per-peer DM isolation
narrow tool access
exec denied or approval-gated
elevated mode off
mention-gated groups

A company boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "team-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": \[
"sessions\_spawn",
"sessions\_send"
\],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"slack": {
"enabled": true,
"dmPolicy": "allowlist",
"allowFrom": \["U123", "U456"\],
"groupPolicy": "allowlist",
"groupAllowFrom": \["U123", "U456"\],
"groups": {
"C0123456789": { "requireMention": true }
}
}
}
}

That kind of shared setup only makes sense when the users are actually inside the same trust boundary and the runtime is kept strictly business-scoped.

So the practical check is simple.
If Alice and a contractor should not have the same authority, they should not be talking to the same powerful OpenClaw agent.

If personal and company data should not mix, they should not share the same gateway runtime.

If you need a true split, split the gateway, split the credentials, and split the host context together.

Separate sessions help privacy.

Separate gateways create the boundary.

One gateway is one trust boundary.
A lot of OpenClaw users understand the words around security but still miss the operational meaning.

If you run one shared gateway and let multiple untrusted people talk to one tool-enabled agent, OpenClaw does not treat that as a safe multi-tenant boundary.

The docs are explicit: one gateway is one trusted operator boundary, and if you need mixed-trust or adversarial-user isolation, you should split that into separate gateways, ideally with separate OS users or separate hosts.

That matters because the real risk is not just “someone can message the bot.”
The real risk is delegated tool authority.
If several untrusted people can message the same tool-enabled agent, they are effectively steering the same permission set.

OpenClaw calls this out directly:

any allowed sender can induce tool calls within that agent’s policy, and if that shared agent has sensitive files, credentials, browser state, or powerful tools attached, every allowed sender is now operating inside that blast radius.

Here is what the bad pattern looks like:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "one-shared-token" }
},
"tools": {
"profile": "default"
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "TEAM_BOT_TOKEN",
"dmPolicy": "open",
"groupPolicy": "open"
}
}
}

One runtime, one token, one tool surface, many people.
That is exactly the kind of setup where people think sessions or prompt rules will save them later.
They will not.

OpenClaw is also clear that session identifiers are routing selectors, not authorization tokens.

Per-user session or memory isolation does not turn one shared agent into per-user host authorization.
If you want the boundary to be real, split the boundary in config and in runtime.

A personal boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "alice-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": [
"group:automation",
"group:runtime",
"group:fs",
"sessions_spawn",
"sessions_send"
],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"telegram": {
"enabled": true,
"botToken": "ALICE_BOT_TOKEN",
"dmPolicy": "pairing",
"allowFrom": ["111111111"],
"groupPolicy": "allowlist",
"groupAllowFrom": ["111111111"],
"groups": {
"-1001111111111": { "requireMention": true }
}
}
}
}

That follows OpenClaw’s hardened direction:

local-only bind
token auth
per-peer DM isolation
narrow tool access
exec denied or approval-gated
elevated mode off
mention-gated groups

A company boundary can look like this:

{
"gateway": {
"mode": "local",
"bind": "loopback",
"auth": { "mode": "token", "token": "team-long-random-token" }
},
"session": {
"dmScope": "per-channel-peer"
},
"tools": {
"profile": "messaging",
"deny": [
"sessions_spawn",
"sessions_send"
],
"fs": { "workspaceOnly": true },
"exec": { "security": "deny", "ask": "always" },
"elevated": { "enabled": false }
},
"channels": {
"slack": {
"enabled": true,
"dmPolicy": "allowlist",
"allowFrom": ["U123", "U456"],
"groupPolicy": "allowlist",
"groupAllowFrom": ["U123", "U456"],
"groups": {
"C0123456789": { "requireMention": true }
}
}
}
}

That kind of shared setup only makes sense when the users are actually inside the same trust boundary and the runtime is kept strictly business-scoped.

So the practical check is simple.
If Alice and a contractor should not have the same authority, they should not be talking to the same powerful OpenClaw agent.

If personal and company data should not mix, they should not share the same gateway runtime.

If you need a true split, split the gateway, split the credentials, and split the host context together.

Separate sessions help privacy.

Separate gateways create the boundary.