Feishu security governance for OpenClaw

Scope of this page

Once OpenClaw is connected to Feishu, it can access group messages, private chats, cloud docs, spreadsheets, calendar, tasks, and contacts. The real questions are: who may connect, to what scope, who reviews it, and how to trace issues.

Permission review: before and after

• Before connecting — Decide which app and permissions you need. Start with the minimum.
• After connecting — Run openclaw security audit --deep regularly to catch misconfigurations and drift.

Minimum required permissions and the official plugin

Grant only what the bot needs. Use the official Feishu plugin and install with:

openclaw plugins install @openclaw/feishu

Dangerous permissions to avoid

• send_as_user / im:message.send_as_user — Lets the agent send as the user. Significantly raises risk.
• offline_access — Allows refresh tokens when the user is offline. Increases exposure if credentials leak.
• Broad document write permissions — e.g. docx:document:write_only, drive:file:upload. Enable only with clear governance.
• Spreadsheet/table write — e.g. base:record:create, base:record:update. Treat as sensitive.

Periodic security audit

openclaw security audit --deep

This helps surface misconfigured permissions, exposed secrets, risky bindings, and overly broad scopes.

Webhook security

If using webhooks: HTTPS only, validate signatures, restrict source IPs where possible, rotate secrets, and audit which services can reach the webhook endpoint.

Sensitive data handling

Do not store passwords, tokens, or customer PII in long-term memory. Request minimum data access. Prefer "preview then confirm" for modifications or sends.

Enterprise administrator priorities

1. Application and bot creation approval.
2. OAuth scope and permission review.
3. Webhook and external endpoint audit.
4. Device and environment controls for terminal-based access.
5. Basic visibility into API calls, permissions, and token usage.

Personal user checklist

1. Test with a personal account first.
2. Request minimum permissions.
3. Preview before sending or modifying.
4. Do not persist sensitive information in agent memory.
5. Stop and investigate on unusual behavior.

External links

• OpenClaw docs
• OpenClaw GitHub
• Feishu open platform
• Security overview
• Feishu channel guide