OpenClaw Feishu access control

Feishu's access model is compact, three DM policies and three group policies, but it has two rules that differ from every other channel: an open group policy switches mention gating off by default so images can still reach the agent, and a broadcast mention to everyone never counts as a mention of the bot. Here are the DM and group policies, the five configuration examples, the bot-to-bot rule, and how to find the IDs.

DMs and groups

• The DM policy defaults to pairing, where unknown users receive a pairing code approved through the pairing list and approve commands; allowlist admits only users listed in the DM allowlist; and open makes DMs public, with config validation requiring the wildcard in the allowlist while non-wildcard entries still narrow access.
• The group policy defaults to allowlist: open responds to all messages in groups, allowlist responds only to groups in the group allowlist or explicitly configured under the groups map, and disabled turns off all group messages, with explicit group entries unable to override it.
• The mention requirement defaults to on, except when the effective group policy is open, where it defaults to off so messages that cannot carry mentions, such as images, still reach the agent; it can be set explicitly and overridden per group under the groups map.
• Broadcast-only mentions of everyone are not treated as bot mentions, a message that mentions both everyone and the bot directly still counts, and mentions of other people stay readable in the text sent to the agent, including when consecutive messages are combined.

Feishu only delivers bot-authored group events when another bot mentions this bot.

The five examples

The docs give five group configurations. Allowing all groups with no mention required is an open group policy alone, since the mention requirement defaults to off under open; allowing all groups but still requiring a mention adds an explicit true. Allowing specific groups only uses the allowlist policy with a group allowlist of chat IDs, which look like an oc-prefixed string; in allowlist mode a group can also be admitted by adding an explicit entry under the groups map, explicit entries never override a disabled policy, and wildcard defaults under the groups map configure matching groups without admitting them by themselves. Restricting senders within a group keeps the allowlist policy and the group allowlist and adds an allowlist of user open IDs, which look like an ou-prefixed string, inside that group's entry; the global group sender allowlist sets the same sender list for all groups, and a per-group allowlist takes precedence.

Bots and IDs

• Feishu ignores messages authored by other bots by default; allowing bot-to-bot group conversations means granting the app the two read-only scopes for group at-messages including bots and for messages, then setting the allow-bots key to true.
• Feishu only delivers bot-authored group events when another bot mentions this bot, the existing group policy, sender allowlists and mention requirements still apply, and OpenClaw drops self-authored messages, mentions the peer bot on every text or card reply, and applies the shared bot loop protection guard.
• A group's chat ID is listed on its settings page, opened from the menu icon in the group's top-right corner, and a user's open ID appears in the logs after a DM to the running bot or in the pending pairing requests.

OpenClaw on Feishu is the channel post these rules belong to, and OpenClaw Feishu message types the message types that reach an admitted conversation.

Why open turns mentions off

An image cannot carry a mention, so a group that requires mentions silently drops every photo; making the open policy default to no mention requirement is the docs' answer, and the two explicit examples exist for teams that want the other combination. OpenClaw access groups covers the shared access-group model, and OpenClaw bot loop protection the guard behind bot-to-bot conversations.

On Diali

Feishu and Lark are not among the channels Diali connects today: WhatsApp, Telegram, Discord, Slack, Mattermost, Matrix, SMS and voice. Hosted OpenClaw on Diali is the assistant and Diali security describes the boundary that applies to each connected channel.

• Open groups skip the mention requirement; allowlist groups keep it.
• Mentioning everyone is never mentioning the bot.
• Chat IDs start with oc, open IDs with ou.