diff --git a/docs/channels/qqbot.md b/docs/channels/qqbot.md
index 764996aa033..3c4a4d4722d 100644
--- a/docs/channels/qqbot.md
+++ b/docs/channels/qqbot.md
@@ -239,12 +239,15 @@ Built-in commands intercepted before the AI queue:
 | `/bot-ping`    | Latency test                                                                                             |
 | `/bot-version` | Show the OpenClaw framework version                                                                      |
 | `/bot-help`    | List all commands                                                                                        |
+| `/bot-me`      | Show the sender's QQ user ID (openid) for `allowFrom`/`groupAllowFrom` setup                             |
 | `/bot-upgrade` | Show the QQBot upgrade guide link                                                                        |
 | `/bot-logs`    | Export recent gateway logs as a file                                                                     |
 | `/bot-approve` | Approve a pending QQ Bot action (for example, confirming a C2C or group upload) through the native flow. |
 
 Append `?` to any command for usage help (for example `/bot-upgrade ?`).
 
+Admin commands (`/bot-me`, `/bot-upgrade`, `/bot-logs`, `/bot-clear-storage`, `/bot-streaming`, `/bot-approve`) are direct-message-only and require the sender's openid in an explicit non-wildcard `allowFrom` list. A wildcard `allowFrom: ["*"]` permits chat but does not grant admin command access. Group messages match against `groupAllowFrom` first and fall back to `allowFrom`. Running an admin command in a group returns a hint rather than silently dropping.
+
 ## Engine architecture
 
 QQ Bot ships as a self-contained engine inside the plugin:
diff --git a/docs/cli/cron.md b/docs/cli/cron.md
index feae8e3c03e..05ff5d3ae81 100644
--- a/docs/cli/cron.md
+++ b/docs/cli/cron.md
@@ -226,6 +226,8 @@ openclaw cron edit <job-id> --session current
 openclaw cron edit <job-id> --session "session:daily-brief"
 ```
 
+`openclaw cron add` warns when `--agent` is omitted on agent-turn jobs and falls back to the default agent (`main`). Pass `--agent <id>` at create time to pin a specific agent.
+
 Delivery tweaks:
 
 ```bash