fix: enforce explicit group auth boundaries across channels

src/imessage/monitor/inbound-processing.ts

@@ -256,10 +256,11 @@ export function resolveIMessageInboundDecision(params: {
   const canDetectMention = mentionRegexes.length > 0;
 
   const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
+  const commandDmAllowFrom = isGroup ? params.allowFrom : effectiveDmAllowFrom;
   const ownerAllowedForCommands =
-    effectiveDmAllowFrom.length > 0
+    commandDmAllowFrom.length > 0
       ? isAllowedIMessageSender({
-          allowFrom: effectiveDmAllowFrom,
+          allowFrom: commandDmAllowFrom,
           sender,
           chatId,
           chatGuid,
@@ -280,7 +281,7 @@ export function resolveIMessageInboundDecision(params: {
   const commandGate = resolveControlCommandGate({
     useAccessGroups,
     authorizers: [
-      { configured: effectiveDmAllowFrom.length > 0, allowed: ownerAllowedForCommands },
+      { configured: commandDmAllowFrom.length > 0, allowed: ownerAllowedForCommands },
       { configured: effectiveGroupAllowFrom.length > 0, allowed: groupAllowedForCommands },
     ],
     allowTextCommands: true,

src/plugin-sdk/command-auth.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import type { OpenClawConfig } from "../config/config.js";
+import { resolveSenderCommandAuthorization } from "./command-auth.js";
+
+const baseCfg = {
+  commands: { useAccessGroups: true },
+} as unknown as OpenClawConfig;
+
+describe("plugin-sdk/command-auth", () => {
+  it("authorizes group commands from explicit group allowlist", async () => {
+    const result = await resolveSenderCommandAuthorization({
+      cfg: baseCfg,
+      rawBody: "/status",
+      isGroup: true,
+      dmPolicy: "pairing",
+      configuredAllowFrom: ["dm-owner"],
+      configuredGroupAllowFrom: ["group-owner"],
+      senderId: "group-owner",
+      isSenderAllowed: (senderId, allowFrom) => allowFrom.includes(senderId),
+      readAllowFromStore: async () => ["paired-user"],
+      shouldComputeCommandAuthorized: () => true,
+      resolveCommandAuthorizedFromAuthorizers: ({ useAccessGroups, authorizers }) =>
+        useAccessGroups && authorizers.some((entry) => entry.configured && entry.allowed),
+    });
+    expect(result.commandAuthorized).toBe(true);
+    expect(result.senderAllowedForCommands).toBe(true);
+    expect(result.effectiveAllowFrom).toEqual(["dm-owner"]);
+    expect(result.effectiveGroupAllowFrom).toEqual(["group-owner"]);
+  });
+
+  it("keeps pairing-store identities DM-only for group command auth", async () => {
+    const result = await resolveSenderCommandAuthorization({
+      cfg: baseCfg,
+      rawBody: "/status",
+      isGroup: true,
+      dmPolicy: "pairing",
+      configuredAllowFrom: ["dm-owner"],
+      configuredGroupAllowFrom: ["group-owner"],
+      senderId: "paired-user",
+      isSenderAllowed: (senderId, allowFrom) => allowFrom.includes(senderId),
+      readAllowFromStore: async () => ["paired-user"],
+      shouldComputeCommandAuthorized: () => true,
+      resolveCommandAuthorizedFromAuthorizers: ({ useAccessGroups, authorizers }) =>
+        useAccessGroups && authorizers.some((entry) => entry.configured && entry.allowed),
+    });
+    expect(result.commandAuthorized).toBe(false);
+    expect(result.senderAllowedForCommands).toBe(false);
+    expect(result.effectiveAllowFrom).toEqual(["dm-owner"]);
+    expect(result.effectiveGroupAllowFrom).toEqual(["group-owner"]);
+  });
+});

src/plugin-sdk/command-auth.ts

@@ -1,4 +1,5 @@
 import type { OpenClawConfig } from "../config/config.js";
+import { resolveDmGroupAccessWithLists } from "../security/dm-policy-shared.js";
 
 export type ResolveSenderCommandAuthorizationParams = {
   cfg: OpenClawConfig;
@@ -6,6 +7,7 @@ export type ResolveSenderCommandAuthorizationParams = {
   isGroup: boolean;
   dmPolicy: string;
   configuredAllowFrom: string[];
+  configuredGroupAllowFrom?: string[];
   senderId: string;
   isSenderAllowed: (senderId: string, allowFrom: string[]) => boolean;
   readAllowFromStore: () => Promise<string[]>;
@@ -21,6 +23,7 @@ export async function resolveSenderCommandAuthorization(
 ): Promise<{
   shouldComputeAuth: boolean;
   effectiveAllowFrom: string[];
+  effectiveGroupAllowFrom: string[];
   senderAllowedForCommands: boolean;
   commandAuthorized: boolean | undefined;
 }> {
@@ -31,14 +34,30 @@ export async function resolveSenderCommandAuthorization(
     (params.dmPolicy !== "open" || shouldComputeAuth)
       ? await params.readAllowFromStore().catch(() => [])
       : [];
-  const effectiveAllowFrom = [...params.configuredAllowFrom, ...storeAllowFrom];
+  const access = resolveDmGroupAccessWithLists({
+    isGroup: params.isGroup,
+    dmPolicy: params.dmPolicy,
+    groupPolicy: "allowlist",
+    allowFrom: params.configuredAllowFrom,
+    groupAllowFrom: params.configuredGroupAllowFrom ?? [],
+    storeAllowFrom,
+    isSenderAllowed: (allowFrom) => params.isSenderAllowed(params.senderId, allowFrom),
+  });
+  const effectiveAllowFrom = access.effectiveAllowFrom;
+  const effectiveGroupAllowFrom = access.effectiveGroupAllowFrom;
   const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
-  const senderAllowedForCommands = params.isSenderAllowed(params.senderId, effectiveAllowFrom);
+  const senderAllowedForCommands = params.isSenderAllowed(
+    params.senderId,
+    params.isGroup ? effectiveGroupAllowFrom : effectiveAllowFrom,
+  );
+  const ownerAllowedForCommands = params.isSenderAllowed(params.senderId, effectiveAllowFrom);
+  const groupAllowedForCommands = params.isSenderAllowed(params.senderId, effectiveGroupAllowFrom);
   const commandAuthorized = shouldComputeAuth
     ? params.resolveCommandAuthorizedFromAuthorizers({
         useAccessGroups,
         authorizers: [
-          { configured: effectiveAllowFrom.length > 0, allowed: senderAllowedForCommands },
+          { configured: effectiveAllowFrom.length > 0, allowed: ownerAllowedForCommands },
+          { configured: effectiveGroupAllowFrom.length > 0, allowed: groupAllowedForCommands },
         ],
       })
     : undefined;
@@ -46,6 +65,7 @@ export async function resolveSenderCommandAuthorization(
   return {
     shouldComputeAuth,
     effectiveAllowFrom,
+    effectiveGroupAllowFrom,
     senderAllowedForCommands,
     commandAuthorized,
   };

src/plugin-sdk/index.ts

@@ -413,6 +413,7 @@ export {
   readStoreAllowFromForDmPolicy,
   resolveDmAllowState,
   resolveDmGroupAccessDecision,
+  resolveDmGroupAccessWithCommandGate,
   resolveDmGroupAccessWithLists,
   resolveEffectiveAllowFromLists,
 } from "../security/dm-policy-shared.js";

src/security/dm-policy-shared.test.ts

@@ -3,6 +3,7 @@ import {
   DM_GROUP_ACCESS_REASON,
   readStoreAllowFromForDmPolicy,
   resolveDmAllowState,
+  resolveDmGroupAccessWithCommandGate,
   resolveDmGroupAccessDecision,
   resolveDmGroupAccessWithLists,
   resolveEffectiveAllowFromLists,
@@ -134,6 +135,66 @@ describe("security/dm-policy-shared", () => {
     expect(resolved.effectiveGroupAllowFrom).toEqual(["group:room"]);
   });
 
+  it("resolves command gate with dm/group parity for groups", () => {
+    const resolved = resolveDmGroupAccessWithCommandGate({
+      isGroup: true,
+      dmPolicy: "pairing",
+      groupPolicy: "allowlist",
+      allowFrom: ["owner"],
+      groupAllowFrom: ["group-owner"],
+      storeAllowFrom: ["paired-user"],
+      isSenderAllowed: (allowFrom) => allowFrom.includes("paired-user"),
+      command: {
+        useAccessGroups: true,
+        allowTextCommands: true,
+        hasControlCommand: true,
+      },
+    });
+    expect(resolved.decision).toBe("block");
+    expect(resolved.reason).toBe("groupPolicy=allowlist (not allowlisted)");
+    expect(resolved.commandAuthorized).toBe(false);
+    expect(resolved.shouldBlockControlCommand).toBe(true);
+  });
+
+  it("keeps configured dm allowlist usable for group command auth", () => {
+    const resolved = resolveDmGroupAccessWithCommandGate({
+      isGroup: true,
+      dmPolicy: "pairing",
+      groupPolicy: "open",
+      allowFrom: ["owner"],
+      groupAllowFrom: [],
+      storeAllowFrom: ["paired-user"],
+      isSenderAllowed: (allowFrom) => allowFrom.includes("owner"),
+      command: {
+        useAccessGroups: true,
+        allowTextCommands: true,
+        hasControlCommand: true,
+      },
+    });
+    expect(resolved.commandAuthorized).toBe(true);
+    expect(resolved.shouldBlockControlCommand).toBe(false);
+  });
+
+  it("treats dm command authorization as dm access result", () => {
+    const resolved = resolveDmGroupAccessWithCommandGate({
+      isGroup: false,
+      dmPolicy: "pairing",
+      groupPolicy: "allowlist",
+      allowFrom: ["owner"],
+      groupAllowFrom: ["group-owner"],
+      storeAllowFrom: ["paired-user"],
+      isSenderAllowed: (allowFrom) => allowFrom.includes("paired-user"),
+      command: {
+        useAccessGroups: true,
+        allowTextCommands: true,
+        hasControlCommand: true,
+      },
+    });
+    expect(resolved.decision).toBe("allow");
+    expect(resolved.commandAuthorized).toBe(true);
+    expect(resolved.shouldBlockControlCommand).toBe(false);
+  });
+
   it("keeps allowlist mode strict in shared resolver (no pairing-store fallback)", () => {
     const resolved = resolveDmGroupAccessWithLists({
       isGroup: false,

src/security/dm-policy-shared.ts

@@ -1,4 +1,5 @@
 import { mergeDmAllowFromSources, resolveGroupAllowFromSources } from "../channels/allow-from.js";
+import { resolveControlCommandGate } from "../channels/command-gating.js";
 import type { ChannelId } from "../channels/plugins/types.js";
 import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
 import { normalizeStringEntries } from "../shared/string-normalization.js";
@@ -182,6 +183,79 @@ export function resolveDmGroupAccessWithLists(params: {
   };
 }
 
+export function resolveDmGroupAccessWithCommandGate(params: {
+  isGroup: boolean;
+  dmPolicy?: string | null;
+  groupPolicy?: string | null;
+  allowFrom?: Array<string | number> | null;
+  groupAllowFrom?: Array<string | number> | null;
+  storeAllowFrom?: Array<string | number> | null;
+  groupAllowFromFallbackToAllowFrom?: boolean | null;
+  isSenderAllowed: (allowFrom: string[]) => boolean;
+  command?: {
+    useAccessGroups: boolean;
+    allowTextCommands: boolean;
+    hasControlCommand: boolean;
+  };
+}): {
+  decision: DmGroupAccessDecision;
+  reason: string;
+  effectiveAllowFrom: string[];
+  effectiveGroupAllowFrom: string[];
+  commandAuthorized: boolean;
+  shouldBlockControlCommand: boolean;
+} {
+  const access = resolveDmGroupAccessWithLists({
+    isGroup: params.isGroup,
+    dmPolicy: params.dmPolicy,
+    groupPolicy: params.groupPolicy,
+    allowFrom: params.allowFrom,
+    groupAllowFrom: params.groupAllowFrom,
+    storeAllowFrom: params.storeAllowFrom,
+    groupAllowFromFallbackToAllowFrom: params.groupAllowFromFallbackToAllowFrom,
+    isSenderAllowed: params.isSenderAllowed,
+  });
+
+  const configuredAllowFrom = normalizeStringEntries(params.allowFrom ?? []);
+  const configuredGroupAllowFrom = normalizeStringEntries(
+    resolveGroupAllowFromSources({
+      allowFrom: configuredAllowFrom,
+      groupAllowFrom: normalizeStringEntries(params.groupAllowFrom ?? []),
+      fallbackToAllowFrom: params.groupAllowFromFallbackToAllowFrom ?? undefined,
+    }),
+  );
+  // Group command authorization must not inherit DM pairing-store approvals.
+  const commandDmAllowFrom = params.isGroup ? configuredAllowFrom : access.effectiveAllowFrom;
+  const commandGroupAllowFrom = params.isGroup
+    ? configuredGroupAllowFrom
+    : access.effectiveGroupAllowFrom;
+  const ownerAllowedForCommands = params.isSenderAllowed(commandDmAllowFrom);
+  const groupAllowedForCommands = params.isSenderAllowed(commandGroupAllowFrom);
+  const commandGate = params.command
+    ? resolveControlCommandGate({
+        useAccessGroups: params.command.useAccessGroups,
+        authorizers: [
+          {
+            configured: commandDmAllowFrom.length > 0,
+            allowed: ownerAllowedForCommands,
+          },
+          {
+            configured: commandGroupAllowFrom.length > 0,
+            allowed: groupAllowedForCommands,
+          },
+        ],
+        allowTextCommands: params.command.allowTextCommands,
+        hasControlCommand: params.command.hasControlCommand,
+      })
+    : { commandAuthorized: false, shouldBlock: false };
+
+  return {
+    ...access,
+    commandAuthorized: params.isGroup ? commandGate.commandAuthorized : access.decision === "allow",
+    shouldBlockControlCommand: params.isGroup && commandGate.shouldBlock,
+  };
+}
+
 export async function resolveDmAllowState(params: {
   provider: ChannelId;
   allowFrom?: Array<string | number> | null;

src/signal/monitor/event-handler.ts

@@ -560,13 +560,14 @@ export function createSignalEventHandler(deps: SignalEventHandlerDeps) {
     }
 
     const useAccessGroups = deps.cfg.commands?.useAccessGroups !== false;
-    const ownerAllowedForCommands = isSignalSenderAllowed(sender, effectiveDmAllow);
+    const commandDmAllow = isGroup ? deps.allowFrom : effectiveDmAllow;
+    const ownerAllowedForCommands = isSignalSenderAllowed(sender, commandDmAllow);
     const groupAllowedForCommands = isSignalSenderAllowed(sender, effectiveGroupAllow);
     const hasControlCommandInMessage = hasControlCommand(messageText, deps.cfg);
     const commandGate = resolveControlCommandGate({
       useAccessGroups,
       authorizers: [
-        { configured: effectiveDmAllow.length > 0, allowed: ownerAllowedForCommands },
+        { configured: commandDmAllow.length > 0, allowed: ownerAllowedForCommands },
         { configured: effectiveGroupAllow.length > 0, allowed: groupAllowedForCommands },
       ],
       allowTextCommands: true,

src/slack/monitor/auth.ts

@@ -9,12 +9,19 @@ import {
 import { resolveSlackChannelConfig } from "./channel-config.js";
 import { normalizeSlackChannelType, type SlackMonitorContext } from "./context.js";
 
-export async function resolveSlackEffectiveAllowFrom(ctx: SlackMonitorContext) {
-  const storeAllowFrom = await readStoreAllowFromForDmPolicy({
-    provider: "slack",
-    dmPolicy: ctx.dmPolicy,
-    readStore: (provider) => readChannelAllowFromStore(provider),
-  });
+export async function resolveSlackEffectiveAllowFrom(
+  ctx: SlackMonitorContext,
+  options?: { includePairingStore?: boolean },
+) {
+  const includePairingStore = options?.includePairingStore === true;
+  const storeAllowFrom =
+    includePairingStore
+      ? await readStoreAllowFromForDmPolicy({
+          provider: "slack",
+          dmPolicy: ctx.dmPolicy,
+          readStore: (provider) => readChannelAllowFromStore(provider),
+        })
+      : [];
   const allowFrom = normalizeAllowList([...ctx.allowFrom, ...storeAllowFrom]);
   const allowFromLower = normalizeAllowListLower(allowFrom);
   return { allowFrom, allowFromLower };
@@ -99,15 +106,15 @@ export async function authorizeSlackSystemEventSender(params: {
     .catch(() => ({}));
   const senderName = senderInfo.name;
 
-  const resolveAllowFromLower = async () =>
-    (await resolveSlackEffectiveAllowFrom(params.ctx)).allowFromLower;
+  const resolveAllowFromLower = async (includePairingStore = false) =>
+    (await resolveSlackEffectiveAllowFrom(params.ctx, { includePairingStore })).allowFromLower;
 
   if (channelType === "im") {
     if (!params.ctx.dmEnabled || params.ctx.dmPolicy === "disabled") {
       return { allowed: false, reason: "dm-disabled", channelType, channelName };
     }
     if (params.ctx.dmPolicy !== "open") {
-      const allowFromLower = await resolveAllowFromLower();
+      const allowFromLower = await resolveAllowFromLower(true);
       const senderAllowListed = isSlackSenderAllowListed({
         allowListLower: allowFromLower,
         senderId,
@@ -126,7 +133,7 @@ export async function authorizeSlackSystemEventSender(params: {
   } else if (!channelId) {
     // No channel context. Apply allowFrom if configured so we fail closed
     // for privileged interactive events when owner allowlist is present.
-    const allowFromLower = await resolveAllowFromLower();
+    const allowFromLower = await resolveAllowFromLower(false);
     if (allowFromLower.length > 0) {
       const senderAllowListed = isSlackSenderAllowListed({
         allowListLower: allowFromLower,

src/slack/monitor/message-handler/prepare.ts

@@ -127,7 +127,9 @@ export async function prepareSlackMessage(params: {
     return null;
   }
 
-  const { allowFromLower } = await resolveSlackEffectiveAllowFrom(ctx);
+  const { allowFromLower } = await resolveSlackEffectiveAllowFrom(ctx, {
+    includePairingStore: isDirectMessage,
+  });
 
   if (isDirectMessage) {
     const directUserId = message.user;

src/slack/monitor/slash.ts

@@ -336,11 +336,14 @@ export async function registerSlackMonitorSlashCommands(params: {
         return;
       }
 
-      const storeAllowFrom = await readStoreAllowFromForDmPolicy({
-        provider: "slack",
-        dmPolicy: ctx.dmPolicy,
-        readStore: (provider) => readChannelAllowFromStore(provider),
-      });
+      const storeAllowFrom =
+        isDirectMessage
+          ? await readStoreAllowFromForDmPolicy({
+              provider: "slack",
+              dmPolicy: ctx.dmPolicy,
+              readStore: (provider) => readChannelAllowFromStore(provider),
+            })
+          : [];
       const effectiveAllowFrom = normalizeAllowList([...ctx.allowFrom, ...storeAllowFrom]);
       const effectiveAllowFromLower = normalizeAllowListLower(effectiveAllowFrom);
 

src/telegram/bot-native-commands.ts

@@ -253,7 +253,7 @@ async function resolveTelegramCommandAuth(params: {
 
   const dmAllow = normalizeDmAllowFromWithStore({
     allowFrom: allowFrom,
-    storeAllowFrom,
+    storeAllowFrom: isGroup ? [] : storeAllowFrom,
     dmPolicy: telegramCfg.dmPolicy ?? "pairing",
   });
   const senderAllowed = isSenderAllowed({

src/web/auto-reply/monitor/process-message.ts

@@ -27,7 +27,10 @@ import type { getChildLogger } from "../../../logging.js";
 import { getAgentScopedMediaLocalRoots } from "../../../media/local-roots.js";
 import { readChannelAllowFromStore } from "../../../pairing/pairing-store.js";
 import type { resolveAgentRoute } from "../../../routing/resolve-route.js";
-import { readStoreAllowFromForDmPolicy } from "../../../security/dm-policy-shared.js";
+import {
+  readStoreAllowFromForDmPolicy,
+  resolveDmGroupAccessWithCommandGate,
+} from "../../../security/dm-policy-shared.js";
 import { jidToE164, normalizeE164 } from "../../../utils.js";
 import { resolveWhatsAppAccount } from "../../accounts.js";
 import { newConnectionId } from "../../reconnect.js";
@@ -49,15 +52,6 @@ export type GroupHistoryEntry = {
   senderJid?: string;
 };
 
-function normalizeAllowFromE164(values: Array<string | number> | undefined): string[] {
-  const list = Array.isArray(values) ? values : [];
-  return list
-    .map((entry) => String(entry).trim())
-    .filter((entry) => entry && entry !== "*")
-    .map((entry) => normalizeE164(entry))
-    .filter((entry): entry is string => Boolean(entry));
-}
-
 async function resolveWhatsAppCommandAuthorized(params: {
   cfg: ReturnType<typeof loadConfig>;
   msg: WebInboundMsg;
@@ -77,38 +71,49 @@ async function resolveWhatsAppCommandAuthorized(params: {
 
   const account = resolveWhatsAppAccount({ cfg: params.cfg, accountId: params.msg.accountId });
   const dmPolicy = account.dmPolicy ?? "pairing";
+  const groupPolicy = account.groupPolicy ?? "allowlist";
   const configuredAllowFrom = account.allowFrom ?? [];
   const configuredGroupAllowFrom =
     account.groupAllowFrom ?? (configuredAllowFrom.length > 0 ? configuredAllowFrom : undefined);
 
-  if (isGroup) {
-    if (!configuredGroupAllowFrom || configuredGroupAllowFrom.length === 0) {
-      return false;
-    }
-    if (configuredGroupAllowFrom.some((v) => String(v).trim() === "*")) {
-      return true;
-    }
-    return normalizeAllowFromE164(configuredGroupAllowFrom).includes(senderE164);
-  }
-
-  const storeAllowFrom = await readStoreAllowFromForDmPolicy({
-    provider: "whatsapp",
-    dmPolicy,
-    readStore: (provider) => readChannelAllowFromStore(provider, process.env, params.msg.accountId),
-  });
-  const combinedAllowFrom = Array.from(
-    new Set([...(configuredAllowFrom ?? []), ...storeAllowFrom]),
-  );
-  const allowFrom =
-    combinedAllowFrom.length > 0
-      ? combinedAllowFrom
+  const storeAllowFrom =
+    isGroup
+      ? []
+      : await readStoreAllowFromForDmPolicy({
+          provider: "whatsapp",
+          dmPolicy,
+          readStore: (provider) =>
+            readChannelAllowFromStore(provider, process.env, params.msg.accountId),
+        });
+  const dmAllowFrom =
+    configuredAllowFrom.length > 0
+      ? configuredAllowFrom
       : params.msg.selfE164
         ? [params.msg.selfE164]
         : [];
-  if (allowFrom.some((v) => String(v).trim() === "*")) {
-    return true;
-  }
-  return normalizeAllowFromE164(allowFrom).includes(senderE164);
+  const access = resolveDmGroupAccessWithCommandGate({
+    isGroup,
+    dmPolicy,
+    groupPolicy,
+    allowFrom: dmAllowFrom,
+    groupAllowFrom: configuredGroupAllowFrom,
+    storeAllowFrom,
+    isSenderAllowed: (allowEntries) => {
+      if (allowEntries.includes("*")) {
+        return true;
+      }
+      const normalizedEntries = allowEntries
+        .map((entry) => normalizeE164(String(entry)))
+        .filter((entry): entry is string => Boolean(entry));
+      return normalizedEntries.includes(senderE164);
+    },
+    command: {
+      useAccessGroups,
+      allowTextCommands: true,
+      hasControlCommand: true,
+    },
+  });
+  return access.commandAuthorized;
 }
 
 export async function processMessage(params: {

src/web/inbound/access-control.ts

@@ -10,7 +10,10 @@ import {
   readChannelAllowFromStore,
   upsertChannelPairingRequest,
 } from "../../pairing/pairing-store.js";
-import { readStoreAllowFromForDmPolicy } from "../../security/dm-policy-shared.js";
+import {
+  readStoreAllowFromForDmPolicy,
+  resolveDmGroupAccessWithLists,
+} from "../../security/dm-policy-shared.js";
 import { isSelfChatMode, normalizeE164 } from "../../utils.js";
 import { resolveWhatsAppAccount } from "../accounts.js";
 
@@ -60,22 +63,18 @@ export async function checkInboundAccessControl(params: {
     accountId: params.accountId,
   });
   const dmPolicy = account.dmPolicy ?? "pairing";
-  const configuredAllowFrom = account.allowFrom;
+  const configuredAllowFrom = account.allowFrom ?? [];
   const storeAllowFrom = await readStoreAllowFromForDmPolicy({
     provider: "whatsapp",
     dmPolicy,
     readStore: (provider) => readChannelAllowFromStore(provider, process.env, account.accountId),
   });
   // Without user config, default to self-only DM access so the owner can talk to themselves.
-  const combinedAllowFrom = Array.from(
-    new Set([...(configuredAllowFrom ?? []), ...storeAllowFrom]),
-  );
   const defaultAllowFrom =
-    combinedAllowFrom.length === 0 && params.selfE164 ? [params.selfE164] : undefined;
-  const allowFrom = combinedAllowFrom.length > 0 ? combinedAllowFrom : defaultAllowFrom;
+    configuredAllowFrom.length === 0 && params.selfE164 ? [params.selfE164] : [];
+  const dmAllowFrom = configuredAllowFrom.length > 0 ? configuredAllowFrom : defaultAllowFrom;
   const groupAllowFrom =
-    account.groupAllowFrom ??
-    (configuredAllowFrom && configuredAllowFrom.length > 0 ? configuredAllowFrom : undefined);
+    account.groupAllowFrom ?? (configuredAllowFrom.length > 0 ? configuredAllowFrom : undefined);
   const isSamePhone = params.from === params.selfE164;
   const isSelfChat = account.selfChatMode ?? isSelfChatMode(params.selfE164, configuredAllowFrom);
   const pairingGraceMs =
@@ -87,18 +86,6 @@ export async function checkInboundAccessControl(params: {
     typeof params.messageTimestampMs === "number" &&
     params.messageTimestampMs < params.connectedAtMs - pairingGraceMs;
 
-  // Pre-compute normalized allowlists for filtering.
-  const dmHasWildcard = allowFrom?.includes("*") ?? false;
-  const normalizedAllowFrom =
-    allowFrom && allowFrom.length > 0
-      ? allowFrom.filter((entry) => entry !== "*").map(normalizeE164)
-      : [];
-  const groupHasWildcard = groupAllowFrom?.includes("*") ?? false;
-  const normalizedGroupAllowFrom =
-    groupAllowFrom && groupAllowFrom.length > 0
-      ? groupAllowFrom.filter((entry) => entry !== "*").map(normalizeE164)
-      : [];
-
   // Group policy filtering:
   // - "open": groups bypass allowFrom, only mention-gating applies
   // - "disabled": block all group messages entirely
@@ -115,8 +102,45 @@ export async function checkInboundAccessControl(params: {
     accountId: account.accountId,
     log: (message) => logVerbose(message),
   });
-  if (params.group && groupPolicy === "disabled") {
-    logVerbose("Blocked group message (groupPolicy: disabled)");
+  const normalizedDmSender = normalizeE164(params.from);
+  const normalizedGroupSender =
+    typeof params.senderE164 === "string" ? normalizeE164(params.senderE164) : null;
+  const access = resolveDmGroupAccessWithLists({
+    isGroup: params.group,
+    dmPolicy,
+    groupPolicy,
+    // Groups intentionally fall back to configured allowFrom only (not DM self-chat fallback).
+    allowFrom: params.group ? configuredAllowFrom : dmAllowFrom,
+    groupAllowFrom,
+    storeAllowFrom,
+    isSenderAllowed: (allowEntries) => {
+      const hasWildcard = allowEntries.includes("*");
+      if (hasWildcard) {
+        return true;
+      }
+      const normalizedEntrySet = new Set(
+        allowEntries
+          .map((entry) => normalizeE164(String(entry)))
+          .filter((entry): entry is string => Boolean(entry)),
+      );
+      if (!params.group && isSamePhone) {
+        return true;
+      }
+      return params.group
+        ? Boolean(normalizedGroupSender && normalizedEntrySet.has(normalizedGroupSender))
+        : normalizedEntrySet.has(normalizedDmSender);
+    },
+  });
+  if (params.group && access.decision !== "allow") {
+    if (access.reason === "groupPolicy=disabled") {
+      logVerbose("Blocked group message (groupPolicy: disabled)");
+    } else if (access.reason === "groupPolicy=allowlist (empty allowlist)") {
+      logVerbose("Blocked group message (groupPolicy: allowlist, no groupAllowFrom)");
+    } else {
+      logVerbose(
+        `Blocked group message from ${params.senderE164 ?? "unknown sender"} (groupPolicy: allowlist)`,
+      );
+    }
     return {
       allowed: false,
       shouldMarkRead: false,
@@ -124,31 +148,6 @@ export async function checkInboundAccessControl(params: {
       resolvedAccountId: account.accountId,
     };
   }
-  if (params.group && groupPolicy === "allowlist") {
-    if (!groupAllowFrom || groupAllowFrom.length === 0) {
-      logVerbose("Blocked group message (groupPolicy: allowlist, no groupAllowFrom)");
-      return {
-        allowed: false,
-        shouldMarkRead: false,
-        isSelfChat,
-        resolvedAccountId: account.accountId,
-      };
-    }
-    const senderAllowed =
-      groupHasWildcard ||
-      (params.senderE164 != null && normalizedGroupAllowFrom.includes(params.senderE164));
-    if (!senderAllowed) {
-      logVerbose(
-        `Blocked group message from ${params.senderE164 ?? "unknown sender"} (groupPolicy: allowlist)`,
-      );
-      return {
-        allowed: false,
-        shouldMarkRead: false,
-        isSelfChat,
-        resolvedAccountId: account.accountId,
-      };
-    }
-  }
 
   // DM access control (secure defaults): "pairing" (default) / "allowlist" / "open" / "disabled".
   if (!params.group) {
@@ -161,7 +160,7 @@ export async function checkInboundAccessControl(params: {
         resolvedAccountId: account.accountId,
       };
     }
-    if (dmPolicy === "disabled") {
+    if (access.decision === "block" && access.reason === "dmPolicy=disabled") {
       logVerbose("Blocked dm (dmPolicy: disabled)");
       return {
         allowed: false,
@@ -170,49 +169,49 @@ export async function checkInboundAccessControl(params: {
         resolvedAccountId: account.accountId,
       };
     }
-    if (dmPolicy !== "open" && !isSamePhone) {
+    if (access.decision === "pairing" && !isSamePhone) {
       const candidate = params.from;
-      const allowed =
-        dmHasWildcard ||
-        (normalizedAllowFrom.length > 0 && normalizedAllowFrom.includes(candidate));
-      if (!allowed) {
-        if (dmPolicy === "pairing") {
-          if (suppressPairingReply) {
-            logVerbose(`Skipping pairing reply for historical DM from ${candidate}.`);
-          } else {
-            const { code, created } = await upsertChannelPairingRequest({
-              channel: "whatsapp",
-              id: candidate,
-              accountId: account.accountId,
-              meta: { name: (params.pushName ?? "").trim() || undefined },
+      if (suppressPairingReply) {
+        logVerbose(`Skipping pairing reply for historical DM from ${candidate}.`);
+      } else {
+        const { code, created } = await upsertChannelPairingRequest({
+          channel: "whatsapp",
+          id: candidate,
+          accountId: account.accountId,
+          meta: { name: (params.pushName ?? "").trim() || undefined },
+        });
+        if (created) {
+          logVerbose(
+            `whatsapp pairing request sender=${candidate} name=${params.pushName ?? "unknown"}`,
+          );
+          try {
+            await params.sock.sendMessage(params.remoteJid, {
+              text: buildPairingReply({
+                channel: "whatsapp",
+                idLine: `Your WhatsApp phone number: ${candidate}`,
+                code,
+              }),
             });
-            if (created) {
-              logVerbose(
-                `whatsapp pairing request sender=${candidate} name=${params.pushName ?? "unknown"}`,
-              );
-              try {
-                await params.sock.sendMessage(params.remoteJid, {
-                  text: buildPairingReply({
-                    channel: "whatsapp",
-                    idLine: `Your WhatsApp phone number: ${candidate}`,
-                    code,
-                  }),
-                });
-              } catch (err) {
-                logVerbose(`whatsapp pairing reply failed for ${candidate}: ${String(err)}`);
-              }
-            }
+          } catch (err) {
+            logVerbose(`whatsapp pairing reply failed for ${candidate}: ${String(err)}`);
           }
-        } else {
-          logVerbose(`Blocked unauthorized sender ${candidate} (dmPolicy=${dmPolicy})`);
         }
-        return {
-          allowed: false,
-          shouldMarkRead: false,
-          isSelfChat,
-          resolvedAccountId: account.accountId,
-        };
       }
+      return {
+        allowed: false,
+        shouldMarkRead: false,
+        isSelfChat,
+        resolvedAccountId: account.accountId,
+      };
+    }
+    if (access.decision !== "allow") {
+      logVerbose(`Blocked unauthorized sender ${params.from} (dmPolicy=${dmPolicy})`);
+      return {
+        allowed: false,
+        shouldMarkRead: false,
+        isSelfChat,
+        resolvedAccountId: account.accountId,
+      };
     }
   }