OpenClaw for Teams: Multi-User Setup Guide

OpenClaw is designed as a personal AI agent, but teams are increasingly sharing a single instance. A well-configured shared agent can serve an entire team — handling questions, running automations, and managing shared knowledge. This guide covers everything you need to set up OpenClaw for multi-user teams.

Why Use One Agent for a Team?

Instead of each team member running their own OpenClaw instance, a shared agent offers:

• Shared knowledge: The agent learns from everyone's interactions and maintains team context
• Lower cost: One server, one set of API keys, shared token budget
• Consistent behavior: Everyone gets the same agent personality and capabilities
• Centralized management: One SOUL.md, one skill set, one configuration

The trade-off is privacy — team members can see each other's conversations in the shared context. We will cover how to handle this.

Setting Up Multi-User Access

Channel-Based Access

The simplest approach: each team member interacts via their own messaging channel.

# config.yaml
channels:
  telegram:
    enabled: true
    token: "${TELEGRAM_BOT_TOKEN}"
    allowed_users:
      - id: "alice_123"
        name: "Alice"
        role: "admin"
      - id: "bob_456"
        name: "Bob"
        role: "member"
      - id: "carol_789"
        name: "Carol"
        role: "member"
  
  email:
    enabled: true
    provider: "inbounter"
    api_key: "${INBOUNTER_API_KEY}"
    allowed_senders:
      - email: "alice@company.com"
        name: "Alice"
        role: "admin"
      - email: "bob@company.com"
        name: "Bob"
        role: "member"

Each user is identified by their channel identity (Telegram user ID, email address, etc.). The agent knows who is talking and can personalize responses.

Group Chat Setup

For team-wide interactions, add the bot to a team group chat:

Telegram Group:

1. Create a Telegram group for your team
2. Add the OpenClaw bot to the group
3. Configure the bot to respond in the group

channels:
  telegram:
    groups:
      - id: "-1001234567890"
        name: "Engineering Team"
        respond_to_all: false  # Only respond when mentioned
        mention_trigger: "@oclawbot"

Slack-Style Integration:

channels:
  slack:
    enabled: true
    token: "${SLACK_BOT_TOKEN}"
    channels:
      - id: "C0123ABC"
        name: "#ai-assistant"

Role-Based Access Control

Not everyone should have the same permissions. Configure roles to restrict what each user can do.

roles:
  admin:
    permissions:
      - execute_commands
      - install_skills
      - modify_config
      - view_all_conversations
      - manage_users
      - manage_cron
    rate_limit: 200  # messages per day
  
  member:
    permissions:
      - execute_commands
      - view_own_conversations
    rate_limit: 100
    blocked_commands:
      - "rm"
      - "sudo"
      - "apt"
  
  viewer:
    permissions:
      - view_own_conversations
    rate_limit: 50
    execute_commands: false

Assigning Roles

# Assign a role to a user
openclaw users add --name "Alice" --channel telegram --id "alice_123" --role admin
openclaw users add --name "Bob" --channel telegram --id "bob_456" --role member
openclaw users add --name "Carol" --channel email --email "carol@company.com" --role viewer

Permission Checks

The agent checks permissions before executing commands:

Bob: Can you restart the production server?
Agent: I don't have permission to execute system commands for your role. 
       Please ask an admin to run this request.

Team SOUL.md

Your SOUL.md needs to account for multiple users. Here is a template:

# Team AI Agent — Engineering Team

## Identity
You are the AI assistant for the Engineering team at Acme Corp.
You help with coding questions, system administration, documentation, 
and team coordination.

## Team Members
- **Alice** (admin): Team lead, full-stack developer
- **Bob** (member): Backend developer, focuses on Go and PostgreSQL
- **Carol** (member): Frontend developer, React and TypeScript
- **Dave** (viewer): Project manager, read-only access

## Communication Style
- Be professional but friendly
- Address team members by name
- Keep responses concise — team members are busy
- When sharing code, include the file path and context

## Team Context
- We use GitHub for version control
- CI/CD is on GitHub Actions
- Production runs on AWS ECS
- Staging deploys automatically on merge to `develop`

## Shared Knowledge
- Sprint planning happens every Monday at 10 AM
- Deploy freeze: Fridays after 3 PM
- Incident response: page the on-call via PagerDuty

## Privacy
- Do not share one user's private conversations with other users
- Team group chat messages are visible to everyone
- When a user asks "what did [name] ask about?", politely decline

## Safety
- Never run destructive commands without admin approval
- Always explain what a command will do before executing
- Log all command executions for audit

Shared Memory

OpenClaw's memory system can be configured for team use:

Shared Context

memory:
  shared:
    enabled: true
    scope: "team"
    # All team members contribute to and benefit from shared memory
  
  private:
    enabled: true
    # Each user's direct messages are stored separately

Knowledge Base

Build a team knowledge base that all members can query:

# Add team documentation to memory
openclaw memory add --scope team --label "deployment" \
  "Production deployment process: 1. Merge to main, 2. Wait for CI, 3. Deploy via GitHub Actions"

openclaw memory add --scope team --label "oncall" \
  "On-call rotation: Week 1 Alice, Week 2 Bob, Week 3 Carol"

Conversation Isolation

By default, one user's conversations are visible to the agent when talking to another user. To isolate:

memory:
  conversation_isolation: true
  # Each user has a separate conversation thread
  # Shared memory is accessible to all, but conversations are private

Cost Management for Teams

Budget Allocation

budget:
  monthly_total: 100.00
  per_user:
    admin: 50.00
    member: 25.00
    viewer: 5.00
  
  alerts:
    threshold: 0.80  # Alert at 80% of budget
    channel: "telegram"
    admin_only: true

Usage Tracking

# View usage by user
openclaw costs breakdown --by-user

# Output:
# User      Model           Tokens      Cost
# Alice     claude-sonnet   1,234,567   $4.50
# Bob       claude-sonnet   890,123     $3.20
# Carol     gemini-flash    456,789     $0.15
# Cron      claude-haiku    234,567     $0.08
# Total                     2,816,046   $7.93

Cost Splitting

Send monthly cost reports to each team member via Inbounter:

openclaw cron add --name "monthly-cost-report" "0 9 1 * *" \
  "Generate a cost report for last month, broken down by team member.
   Email the report to team-lead@company.com via Inbounter.
   Include total cost, per-user breakdown, and top 5 most expensive queries."

Multi-Instance Approach

Some teams prefer running separate OpenClaw instances per team or project:

# docker-compose.yml
services:
  openclaw-engineering:
    image: openclaw/openclaw:latest
    ports:
      - "127.0.0.1:3080:3080"
    volumes:
      - ./engineering/config:/app/config
      - ./engineering/data:/app/data
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}

  openclaw-marketing:
    image: openclaw/openclaw:latest
    ports:
      - "127.0.0.1:3081:3080"
    volumes:
      - ./marketing/config:/app/config
      - ./marketing/data:/app/data
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}

Each instance has its own SOUL.md, memory, and skills. Users interact with the instance relevant to their team.

Onboarding New Team Members

Step 1: Add the User

openclaw users add --name "Eve" --channel telegram --id "eve_101" --role member

Step 2: Send Welcome Message

Configure an automatic welcome when a new user first interacts:

onboarding:
  welcome_message: |
    Welcome to the team AI assistant! Here's what I can help with:
    - Answer coding questions
    - Run approved commands on our servers
    - Search our documentation
    - Schedule reminders
    
    Type /help for available commands.
    Type /skills to see what I can do.

Step 3: Notify the Team

Use Inbounter to send a team notification:

onboarding:
  notify_admin:
    enabled: true
    provider: "inbounter"
    email: "team-lead@company.com"
    message: "New team member {{name}} has been added to the AI assistant."

Security Considerations

Audit Logging

Enable comprehensive logging for team deployments:

logging:
  audit:
    enabled: true
    include_prompts: true
    include_responses: true
    retention_days: 90
    export_format: "json"

# View audit log
openclaw audit --user "bob" --since "7d"

# Export for compliance
openclaw audit export --format csv --period "2026-03" > march-audit.csv

API Key Isolation

Use separate API keys per team if possible. This allows:

• Independent spending limits
• Separate usage tracking
• Revoking access for one team without affecting others

Data Access Controls

security:
  data_access:
    file_system:
      allowed_paths:
        - "/home/projects/"
        - "/var/log/"
      blocked_paths:
        - "/etc/"
        - "/root/"
        - "/home/*/private/"

Enterprise Considerations

For larger organizations:

SSO Integration

OpenClaw's admin panel can integrate with SSO providers:

auth:
  provider: "oidc"
  issuer: "https://sso.company.com"
  client_id: "${OIDC_CLIENT_ID}"
  client_secret: "${OIDC_CLIENT_SECRET}"
  allowed_groups:
    - "engineering"
    - "devops"

Compliance

• Data residency: Choose a server location that meets your compliance requirements (EU for GDPR, etc.)
• Data retention: Configure automatic deletion of conversations older than your retention policy
• Encryption: Enable disk encryption for data at rest

SLA Monitoring

Set up health checks that alert your team when the agent is down:

openclaw cron add --name "health-ping" "*/5 * * * *" \
  "Check agent health. If any component is degraded, send an alert 
   email via Inbounter to ops@company.com and SMS to the on-call number."

Frequently Asked Questions

How many users can share one OpenClaw instance?

There is no hard limit. Practically, 5-20 users work well on a standard VPS. Beyond that, consider multiple instances or a more powerful server.

Can different users use different LLM models?

Yes, via role configuration:

roles:
  admin:
    default_model: "claude-opus-4-20250514"
  member:
    default_model: "claude-sonnet-4-20250514"

How do I handle confidential conversations?

Enable conversation isolation and instruct the agent in SOUL.md to never share one user's private conversations with another. For truly confidential work, use separate instances.

Can team members install their own skills?

Only if their role has the install_skills permission. We recommend restricting this to admins to prevent untrusted skills from affecting the shared environment.

What happens when a team member leaves?

openclaw users remove --id "eve_101"
# Optionally clear their conversation history
openclaw memory clear --user "eve_101"

Can I set up different SOUL.md for different users?

Not directly. The SOUL.md is shared. However, you can include per-user sections that the agent references when talking to specific users.