Quick Start
Restrict regular users in YAML
123 is admin (all commands). User 456 may only run help, status, and whoami.How It Works
Built-in Commands
| Command | Description | Always allowed? |
|---|---|---|
/help | Show help (filtered to caller’s permissions) | Yes |
/whoami | User ID, username, role, allowed commands | Yes |
/status | Agent name, model, platform, uptime | No |
/new | Reset the conversation session | No |
/stop | Cancel the current agent task | No |
ALWAYS_ALLOWED = {"help", "whoami"} — these cannot be locked away from any user.
Configuration
| Option | Type | Default | Description |
|---|---|---|---|
admin_users | str | None | Comma-separated user IDs who can run any command |
user_allowed_commands | str | None | Comma-separated commands regular users may run. None = no restrictions |
Choosing a Setup
Best Practices
Pair with allowed_users
Pair with allowed_users
Per-command access layers on top of user allowlists — it does not replace them.
Reserve /new and /stop for admins in production
Reserve /new and /stop for admins in production
Both have side effects: resetting state and cancelling tasks.
Use /whoami when debugging permissions
Use /whoami when debugging permissions
Shows the exact allow list resolved for the caller.
Add custom commands to user_allowed_commands
Add custom commands to user_allowed_commands
Register with
bot.register_command("ping", handler) then include "ping" in the allowlist for non-admins.Related
Bot Chat Commands
Built-in and custom commands
Bot Security
DM policy and safe defaults

