fix: default groupPolicy to allowlist

docs/gateway/configuration-examples.md

@@ -150,7 +150,8 @@ Save to `~/.clawdbot/clawdbot.json` and you can DM the bot from that number.
   whatsapp: {
     dmPolicy: "pairing",
     allowFrom: ["+15555550123"],
-    groupPolicy: "open",
+    groupPolicy: "allowlist",
+    groupAllowFrom: ["+15555550123"],
     groups: { "*": { requireMention: true } }
   },
 
@@ -158,7 +159,8 @@ Save to `~/.clawdbot/clawdbot.json` and you can DM the bot from that number.
     enabled: true,
     botToken: "YOUR_TELEGRAM_BOT_TOKEN",
     allowFrom: ["123456789"],
-    groupPolicy: "open",
+    groupPolicy: "allowlist",
+    groupAllowFrom: ["123456789"],
     groups: { "*": { requireMention: true } }
   },
 

docs/gateway/configuration.md

@@ -545,12 +545,13 @@ Use `*.groupPolicy` to control whether group/room messages are accepted at all:
 ```
 
 Notes:
-- `"open"` (default): groups bypass allowlists; mention-gating still applies.
+- `"open"`: groups bypass allowlists; mention-gating still applies.
 - `"disabled"`: block all group/room messages.
 - `"allowlist"`: only allow groups/rooms that match the configured allowlist.
 - WhatsApp/Telegram/Signal/iMessage use `groupAllowFrom` (fallback: explicit `allowFrom`).
 - Discord/Slack use channel allowlists (`discord.guilds.*.channels`, `slack.channels`).
 - Group DMs (Discord/Slack) are still controlled by `dm.groupEnabled` + `dm.groupChannels`.
+- Default is `groupPolicy: "allowlist"`; if no allowlist is configured, group messages are blocked.
 
 ### Multi-agent routing (`agents.list` + `bindings`)