Bot Command Access Control

Restrict who can run which bot commands with admin users and per-user command allowlists — applies uniformly to Telegram, Slack, and Discord bots.

from praisonaiagents import Agent
from praisonaiagents import BotConfig

agent = Agent(name="assistant", instructions="You are a helpful assistant.")
config = BotConfig(admin_users="123456789", user_allowed_commands={})
agent.start("Restrict /learn to admins only")

Per-command access control layers on top of user allowlists — admins run any command, regular users only run commands you explicitly permit. CommandAccessPolicy applies uniformly to Telegram, Slack, and Discord bots via the shared CommandRegistry.

The user sends a restricted slash command; admins pass the policy check while other users only run commands on their allowlist.

graph LR
    subgraph "Command Access Control"
        T[Telegram]
        S[Slack]
        D[Discord]
        T --> Cmd[/command]
        S --> Cmd
        D --> Cmd
        Cmd --> Policy{Policy Check}
        Policy -->|Admin| Run[Run]
        Policy -->|Allowed| Run
        Policy -->|Denied| Block[⛔ Denied]
    end

    classDef agent fill:#8B0000,color:#fff
    classDef tool fill:#189AB4,color:#fff

    class Run agent
    class T,S,D,Cmd,Policy,Block tool

Privileged Commands

Privileged commands (/learn today) are admin-only by default whenever any policy is configured. They stay open when neither admin_users nor user_allowed_commands is set, so existing deployments are unaffected. To grant a regular user a privileged command, add it explicitly to user_allowed_commands.

The conversation-control commands (/undo, /sessions, /resume, /retry, /reasoning) are not privileged — they follow the same rules as /stop, /model, and /usage. Regular users can run them whenever the policy allows non-privileged commands.

Quick Start

1. Set admin_users in YAML

   channels:
     telegram:
       token: ${TELEGRAM_BOT_TOKEN}
       admin_users: "123"
     slack:
       bot_token: ${SLACK_BOT_TOKEN}
       app_token: ${SLACK_APP_TOKEN}
       admin_users: "U01ABCDEF"
     discord:
       token: ${DISCORD_BOT_TOKEN}
       admin_users: "555000000000000000"

   Once admin_users is set, /learn is admin-only on every channel. No allow-list needed for the privileged guard to activate.

2. Or configure in Python

   Telegram

   from praisonaiagents import Agent
   from praisonaiagents import BotConfig
   from praisonai.bots import TelegramBot
   
   bot = TelegramBot(
       token="YOUR_TOKEN",
       agent=Agent(name="assistant"),
       config=BotConfig(admin_users="123"),
   )

   Slack

   from praisonaiagents import Agent
   from praisonaiagents import BotConfig
   from praisonai.bots import SlackBot
   
   bot = SlackBot(
       agent=Agent(name="assistant"),
       config=BotConfig(admin_users="U01ABCDEF"),
   )

   Discord

   from praisonaiagents import Agent
   from praisonaiagents import BotConfig
   from praisonai.bots import DiscordBot
   
   bot = DiscordBot(
       agent=Agent(name="assistant"),
       config=BotConfig(admin_users="555000000000000000"),
   )

3. Grant /learn to a specific regular user

   admin_users: "123"
   user_allowed_commands: "help,status,learn"

   User 123 is admin (everything). Regular users can also run /learn, /status, and /help.

How It Works

Policy truth table (from the SDK test suite):

Built-in Commands

ALWAYS_ALLOWED = {"help", "whoami"} — these cannot be locked away from any user.

PRIVILEGED_COMMANDS = {"learn"} — admin-only whenever a policy is configured (admin_users or user_allowed_commands set). Available to all users when no policy is configured (backward-compatible).

Configuration

A policy is “configured” if either admin_users is non-empty or user_allowed_commands is not None (even if empty). Once configured, the privileged-command guard is active.

Choosing a Setup

Best Practices

Related