---
name: "WhatsApp phone number allowlist authorization"
---

# Story 389: WhatsApp phone number allowlist authorization

## User Story

As a bot operator, I want to restrict which phone numbers can interact with the bot, so that only authorized users can send commands.

## Acceptance Criteria

- [ ] New optional allowed_phones list in bot.toml for WhatsApp (similar to Matrix allowed_users)
- [ ] When configured, only messages from listed phone numbers are processed; all others are silently ignored
- [ ] When not configured (empty or absent), all phone numbers are allowed (backwards compatible)
- [ ] Unauthorized senders are logged but receive no response
- [ ] The allowlist applies to all message types: commands, LLM conversations, and async commands (htop, delete)

## Out of Scope

- TBD
