@@ -8,13 +8,13 @@ steps. Check items off as they land.
 ## Priority order (fix these first)
 
 1. **#1** — Telegram document path traversal (remote arbitrary-write/RCE). ✅ Fixed
-2. **#3** — Fail-open Telegram authorization (amplifies #1).
+2. **#3** — Fail-open Telegram authorization (amplifies #1). ✅ Fixed
 3. **#2** — `trustAll` never resets within a run (one click unlocks the turn). ✅ Fixed
 4. **#4 / #5** — WS auth + serve-mode approval deadlock.
 
-> Status: #1 and #2 are implemented and tested in this PR. The remaining items
-> are open. #3, #4, #6 involve a behavior/default change (fail-closed auth, WS
-> token) and are left for maintainer direction.
+> Status: #1, #2, and #3 are implemented and tested in this PR. The remaining
+> items are open. #4 and #6 involve a behavior/default change (WS token) and are
+> left for maintainer direction.
 
 ---
 
@@ -56,6 +56,13 @@ steps. Check items off as they land.
   same run still triggers `PromptCommand`.
 
 ## 3. Fail-open Telegram authorization
+- **Status:** ✅ Fixed — `ValidateConfig` now refuses to start with no allowlist
+  unless `ODEK_TELEGRAM_ALLOW_ALL=true` is set; `isAllowed` is fail-closed
+  (empty lists + no opt-in → deny); startup logs a loud warning when running
+  open. Tests: `TestValidateConfig_noAllowlistFailsClosed`,
+  `TestValidateConfig_allowAllOptIn`, `TestConfigFromEnv_allowAll`,
+  `TestIsAllowed_EmptyAllowlist` (now asserts deny),
+  `TestIsAllowed_EmptyAllowlistWithAllowAll`.
 - **Severity:** High
 - **Location:** `internal/telegram/handler.go:505-533`; defaults in
   `internal/telegram/config.go`
 
@@ -159,10 +159,18 @@ func telegramCmd(args []string) error {
 
 	// 8. Set handler config from cfg.
 	handler.Config = telegram.HandlerConfig{
-		AllowedChats: cfg.AllowedChats,
-		BotUsername:  cfg.BotUsername,
-		MaxMsgLength: cfg.MaxMsgLength,
-		AllowedUsers: cfg.AllowedUsers,
+		AllowedChats:  cfg.AllowedChats,
+		BotUsername:   cfg.BotUsername,
+		MaxMsgLength:  cfg.MaxMsgLength,
+		AllowedUsers:  cfg.AllowedUsers,
+		AllowAllUsers: cfg.AllowAllUsers,
+	}
+
+	// Loud warning when running without an allowlist (only reachable when the
+	// operator explicitly set ODEK_TELEGRAM_ALLOW_ALL; ValidateConfig blocks
+	// the accidental case).
+	if cfg.AllowAllUsers && len(cfg.AllowedChats) == 0 && len(cfg.AllowedUsers) == 0 {
+		handlerLog.Warn("telegram bot is running with NO allowlist — ANY user can drive the agent (ODEK_TELEGRAM_ALLOW_ALL=true)")
 	}
 
 	// 9. Build system prompt: explicit override > IDENTITY.md > compiled default
 
@@ -41,9 +41,13 @@ GIT_COMMITTER_EMAIL=you@example.com
 
 # ── Telegram bot (only for the telegram-* profiles) ──────────────────────
 # Get a token from @BotFather; restrict to YOUR chat/user id.
+# REQUIRED: set at least one allowlist below — the bot refuses to start with
+# none (fail-closed). Any Telegram user who finds an open bot can drive the
+# agent and its shell/file tools.
 # ODEK_TELEGRAM_BOT_TOKEN=123456:ABC-your-bot-token
 # ODEK_TELEGRAM_ALLOWED_CHATS=11111111        # comma-separated chat IDs
 # ODEK_TELEGRAM_ALLOWED_USERS=11111111        # comma-separated user IDs (optional)
+# ODEK_TELEGRAM_ALLOW_ALL=true                # DANGER: run with NO allowlist (any user). Not recommended.
 # Chat ID that `odek run --deliver` and scheduled reminders send to.
 # Required for Telegram delivery; usually your own chat ID from ALLOWED_CHATS.
 # ODEK_TELEGRAM_DEFAULT_CHAT_ID=11111111
 
@@ -217,7 +217,7 @@ odek audit <session-id> | jq …    # programmatic triage
 
 `AllowedChats` and `AllowedUsers` are loaded from `[telegram]` config or `ODEK_TELEGRAM_ALLOWED_CHATS` / `…_USERS` env vars. When non-empty, the handler rejects any update whose `chat.id` / `user.id` is not in the list **before** any tool call is reached. Denied attempts are logged so you can notice scanning.
 
-If you run the bot at all, **set the allowlist**. The bot is the only internet-exposed surface, and the agent it drives has full host access.
+Authorization is **fail-closed**: if neither allowlist is configured, the bot refuses to start (`ValidateConfig` returns an error), and at runtime `isAllowed` denies every update. The bot is the only internet-exposed surface and the agent it drives has full host access, so an empty allowlist must never silently mean "allow everyone". To intentionally run an open bot you must explicitly set `ODEK_TELEGRAM_ALLOW_ALL=true`, which logs a loud warning at startup.
 
 ### 13. Identity anchoring (legacy)
 
 
@@ -31,8 +31,9 @@ All configuration flows through `TelegramConfig` and can be set via environment
 | Variable | Field | Default |
 |---|---|---|
 | `ODEK_TELEGRAM_BOT_TOKEN` | Token | — (required) |
-| `ODEK_TELEGRAM_ALLOWED_CHATS` | AllowedChats | all |
-| `ODEK_TELEGRAM_ALLOWED_USERS` | AllowedUsers | all |
+| `ODEK_TELEGRAM_ALLOWED_CHATS` | AllowedChats | — (see below) |
+| `ODEK_TELEGRAM_ALLOWED_USERS` | AllowedUsers | — (see below) |
+| `ODEK_TELEGRAM_ALLOW_ALL` | AllowAllUsers | false |
 | `ODEK_TELEGRAM_BOT_USERNAME` | BotUsername | — |
 | `ODEK_TELEGRAM_POLL_INTERVAL` | PollInterval | 1s |
 | `ODEK_TELEGRAM_POLL_TIMEOUT` | PollTimeout | 30s |
@@ -181,10 +182,19 @@ All callbacks return a response string (may be empty) and an error. The `Handle`
 ### Access Control
 
 `HandlerConfig` supports:
-- **AllowedChats** — restrict to specific chat IDs (empty = allow all)
-- **AllowedUsers** — restrict to specific user IDs (empty = allow all)
+- **AllowedChats** — restrict to specific chat IDs
+- **AllowedUsers** — restrict to specific user IDs
+- **AllowAllUsers** — explicit opt-in to run with no allowlist (see below)
 - **BotUsername** — for `@mention` detection in groups
 
+> **Fail-closed authorization.** The bot **refuses to start** if neither
+> `ODEK_TELEGRAM_ALLOWED_CHATS` nor `ODEK_TELEGRAM_ALLOWED_USERS` is set, so an
+> open bot — where any Telegram user could drive the agent and its shell/file
+> tools — can never be deployed by accident. To intentionally run an open bot,
+> set `ODEK_TELEGRAM_ALLOW_ALL=true` (logged as a loud warning at startup). At
+> runtime, with both allowlists empty and `AllowAllUsers` unset, every update is
+> denied.
+
 ### Inline Keyboards
 
 The handler uses `sync.Map` for `TelegramApprover` instances, keyed by `chatID`. This allows the agent to send inline keyboard approval requests (yes/no) and receive responses via callback queries. The handler intercepts callback queries matching pending approval requests before dispatching to `OnCallbackQuery`.
 
@@ -24,6 +24,11 @@ type TelegramConfig struct {
 	LogLevel         string   `json:"log_level"`       // "debug","info","warn","error" (default "info")
 	LogFile          string   `json:"log_file"`        // path or empty for stderr
 	DefaultChatID    int64    `json:"default_chat_id"` // for --deliver and cron delivery
+	// AllowAllUsers must be explicitly set to true to run the bot with NO
+	// allowlist (any Telegram user may drive the agent). Without it, an empty
+	// AllowedChats + AllowedUsers is a fatal misconfiguration (fail-closed) so
+	// an open bot can never be deployed by accident. Env: ODEK_TELEGRAM_ALLOW_ALL.
+	AllowAllUsers bool `json:"allow_all_users"`
 }
 
 // DefaultConfig returns a TelegramConfig with sensible defaults.
@@ -52,6 +57,9 @@ func ConfigFromEnv(base TelegramConfig) TelegramConfig {
 	if v := os.Getenv("ODEK_TELEGRAM_ALLOWED_USERS"); v != "" {
 		cfg.AllowedUsers = parseInt64List(v)
 	}
+	if v := os.Getenv("ODEK_TELEGRAM_ALLOW_ALL"); v != "" {
+		cfg.AllowAllUsers = parseBool(v)
+	}
 	if v := os.Getenv("ODEK_TELEGRAM_BOT_USERNAME"); v != "" {
 		cfg.BotUsername = v
 	}
@@ -127,9 +135,29 @@ func ValidateConfig(cfg TelegramConfig) error {
 	if cfg.AgentTimeout < 0 {
 		return fmt.Errorf("telegram: agent_timeout_seconds must be >= 0, got %d", cfg.AgentTimeout)
 	}
+	// Fail-closed authorization: refuse to start an unrestricted bot unless the
+	// operator explicitly opts in. An empty allowlist would otherwise let ANY
+	// Telegram user drive the agent (and its shell/file tools). Checked last so
+	// field-level validation errors surface first.
+	if len(cfg.AllowedChats) == 0 && len(cfg.AllowedUsers) == 0 && !cfg.AllowAllUsers {
+		return fmt.Errorf("telegram: no allowlist configured — set ODEK_TELEGRAM_ALLOWED_CHATS " +
+			"and/or ODEK_TELEGRAM_ALLOWED_USERS to restrict access, or set " +
+			"ODEK_TELEGRAM_ALLOW_ALL=true to explicitly run an open bot (NOT recommended)")
+	}
 	return nil
 }
 
+// parseBool parses common truthy string values ("true", "1", "yes", "on",
+// case-insensitive). Anything else is false.
+func parseBool(s string) bool {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case "true", "1", "yes", "on":
+		return true
+	default:
+		return false
+	}
+}
+
 // parseInt64List parses a comma-separated string of integers into a slice of int64.
 func parseInt64List(s string) []int64 {
 	parts := splitAndTrim(s)
 
@@ -366,11 +366,12 @@ func TestConfigFromEnv_multipleOverrides(t *testing.T) {
 
 func TestValidateConfig_valid(t *testing.T) {
 	cfg := TelegramConfig{
-		Token:        "valid:token",
-		PollInterval: 1,
-		PollTimeout:  30,
-		MaxMsgLength: 4096,
-		SessionTTL:   24,
+		Token:         "valid:token",
+		PollInterval:  1,
+		PollTimeout:   30,
+		MaxMsgLength:  4096,
+		SessionTTL:    24,
+		AllowAllUsers: true,
 	}
 	if err := ValidateConfig(cfg); err != nil {
 		t.Errorf("ValidateConfig() = %v, want nil", err)
@@ -384,22 +385,80 @@ func TestValidateConfig_validMinimal(t *testing.T) {
 		PollTimeout:  1,
 		MaxMsgLength: 1,
 		SessionTTL:   1,
+		AllowedUsers: []int64{123}, // satisfies fail-closed check via allowlist
 	}
 	if err := ValidateConfig(cfg); err != nil {
 		t.Errorf("ValidateConfig() = %v, want nil", err)
 	}
 }
 
 func TestValidateConfig_validMaximums(t *testing.T) {
+	cfg := TelegramConfig{
+		Token:         "abc",
+		PollInterval:  999,
+		PollTimeout:   60,
+		MaxMsgLength:  4096,
+		SessionTTL:    8760,
+		AllowAllUsers: true,
+	}
+	if err := ValidateConfig(cfg); err != nil {
+		t.Errorf("ValidateConfig() = %v, want nil", err)
+	}
+}
+
+func TestValidateConfig_noAllowlistFailsClosed(t *testing.T) {
+	// A config with a token but no allowlist and no explicit opt-in must be
+	// rejected (fail-closed) so an open bot can't be deployed by accident.
+	cfg := TelegramConfig{
+		Token:        "abc",
+		PollInterval: 1,
+		PollTimeout:  30,
+		MaxMsgLength: 4096,
+		SessionTTL:   24,
+	}
+	err := ValidateConfig(cfg)
+	if err == nil {
+		t.Fatal("ValidateConfig() = nil, want error about missing allowlist")
+	}
+	if !contains(err.Error(), "no allowlist configured") {
+		t.Errorf("unexpected error: %q", err.Error())
+	}
+}
+
+func TestValidateConfig_allowAllOptIn(t *testing.T) {
+	cfg := TelegramConfig{
+		Token:         "abc",
+		PollInterval:  1,
+		PollTimeout:   30,
+		MaxMsgLength:  4096,
+		SessionTTL:    24,
+		AllowAllUsers: true,
+	}
+	if err := ValidateConfig(cfg); err != nil {
+		t.Errorf("ValidateConfig() with AllowAllUsers = %v, want nil", err)
+	}
+}
+
+func TestValidateConfig_allowlistSatisfiesCheck(t *testing.T) {
 	cfg := TelegramConfig{
 		Token:        "abc",
-		PollInterval: 999,
-		PollTimeout:  60,
+		PollInterval: 1,
+		PollTimeout:  30,
 		MaxMsgLength: 4096,
-		SessionTTL:   8760,
+		SessionTTL:   24,
+		AllowedChats: []int64{42},
 	}
 	if err := ValidateConfig(cfg); err != nil {
-		t.Errorf("ValidateConfig() = %v, want nil", err)
+		t.Errorf("ValidateConfig() with allowlist = %v, want nil", err)
+	}
+}
+
+func TestConfigFromEnv_allowAll(t *testing.T) {
+	unsetAllEnvVars(t)
+	t.Setenv("ODEK_TELEGRAM_ALLOW_ALL", "true")
+	cfg := ConfigFromEnv(DefaultConfig())
+	if !cfg.AllowAllUsers {
+		t.Error("ConfigFromEnv did not set AllowAllUsers from ODEK_TELEGRAM_ALLOW_ALL=true")
 	}
 }
 
@@ -732,11 +791,12 @@ func splitAt(s string, sep byte) string {
 // validConfig returns a TelegramConfig that passes ValidateConfig.
 func validConfig() TelegramConfig {
 	return TelegramConfig{
-		Token:        "test:token",
-		PollInterval: 1,
-		PollTimeout:  30,
-		MaxMsgLength: 4096,
-		SessionTTL:   24,
+		Token:         "test:token",
+		PollInterval:  1,
+		PollTimeout:   30,
+		MaxMsgLength:  4096,
+		SessionTTL:    24,
+		AllowAllUsers: true, // satisfy fail-closed authorization check
 	}
 }
 
 
@@ -73,6 +73,7 @@ func TestE2E_FullTextMessageFlow(t *testing.T) {
 	poller := NewPoller(bot)
 	poller.Timeout = 0 // don't wait in tests
 	handler := NewHandler(bot)
+	handler.Config.AllowAllUsers = true // routing test
 
 	// Set up the text message callback.
 	var (
@@ -198,6 +199,7 @@ func TestE2E_FullCommandFlow(t *testing.T) {
 	poller := NewPoller(bot)
 	poller.Timeout = 0
 	handler := NewHandler(bot)
+	handler.Config.AllowAllUsers = true // routing test
 
 	var (
 		capturedChatID int64
@@ -328,6 +330,7 @@ func TestE2E_FullCallbackFlow(t *testing.T) {
 	poller := NewPoller(bot)
 	poller.Timeout = 0
 	handler := NewHandler(bot)
+	handler.Config.AllowAllUsers = true // routing test
 
 	var (
 		capturedChatID int64
@@ -446,6 +449,7 @@ func TestE2E_PollThenHandlerFlow(t *testing.T) {
 	poller := NewPoller(bot)
 	poller.Timeout = 0
 	handler := NewHandler(bot)
+	handler.Config.AllowAllUsers = true // routing test
 
 	// Track how many text messages and their content.
 	var (
@@ -614,6 +618,7 @@ func TestE2E_MediaFlow(t *testing.T) {
 	poller := NewPoller(bot)
 	poller.Timeout = 0
 	handler := NewHandler(bot)
+	handler.Config.AllowAllUsers = true // routing test
 
 	// OnTextMessage returns a MEDIA:photo response.
 	handler.OnTextMessage = func(chatID int64, messageID int, text string) (string, error) {
@@ -715,6 +720,7 @@ func TestE2E_VoiceMediaFlow(t *testing.T) {
 	poller := NewPoller(bot)
 	poller.Timeout = 0
 	handler := NewHandler(bot)
+	handler.Config.AllowAllUsers = true // routing test
 
 	handler.OnTextMessage = func(chatID int64, messageID int, text string) (string, error) {
 		return "MEDIA:voice:" + tmpPath, nil
@@ -804,6 +810,7 @@ func TestE2E_PollEmptyThenMessage(t *testing.T) {
 	poller := NewPoller(bot)
 	poller.Timeout = 0
 	handler := NewHandler(bot)
+	handler.Config.AllowAllUsers = true // routing test
 
 	var messagesReceived []string
 	handler.OnTextMessage = func(chatID int64, messageID int, text string) (string, error) {
@@ -925,6 +932,7 @@ func TestE2E_InlineKeyboardResponse(t *testing.T) {
 	poller := NewPoller(bot)
 	poller.Timeout = 0
 	handler := NewHandler(bot)
+	handler.Config.AllowAllUsers = true // routing test
 
 	handler.OnCommand = func(chatID int64, messageID int, cmd string, args string) (string, error) {
 		return "Here are your options:", nil
 
@@ -11,10 +11,14 @@ import (
 
 // HandlerConfig controls which messages the Handler processes.
 type HandlerConfig struct {
-	AllowedChats []int64 // empty = allow all
+	AllowedChats []int64 // restricts by chat ID; empty + AllowAllUsers required to allow any
 	BotUsername  string  // for @mention detection in groups (without @)
 	MaxMsgLength int     // default: 4096
-	AllowedUsers []int64 // empty = allow all users
+	AllowedUsers []int64 // restricts by user ID; empty + AllowAllUsers required to allow any
+	// AllowAllUsers must be true to permit access when BOTH allowlists are
+	// empty. Default false = fail-closed (deny everyone) so an unconfigured
+	// handler never silently allows all users. See ValidateConfig.
+	AllowAllUsers bool
 }
 
 // ─── Handler ──────────────────────────────────────────────────────────────
@@ -501,8 +505,15 @@ func (h *Handler) sendChunk(chatID int64, chunk string, replyToMessageID int) {
 // ─── Access Control ───────────────────────────────────────────────────────
 
 // isAllowed checks if the given chat and user are allowed to interact.
-// Returns true if both pass (or their respective allowlists are empty).
+// When both allowlists are empty, access is denied unless AllowAllUsers was
+// explicitly enabled (fail-closed). When a list is non-empty, the corresponding
+// ID must appear in it.
 func (h *Handler) isAllowed(chatID int64, userID int64) bool {
+	// Fail-closed: with no allowlist at all, deny unless explicitly opted in.
+	if len(h.Config.AllowedChats) == 0 && len(h.Config.AllowedUsers) == 0 {
+		return h.Config.AllowAllUsers
+	}
+
 	if len(h.Config.AllowedChats) > 0 {
 		found := false
 		for _, id := range h.Config.AllowedChats {
 
@@ -73,6 +73,7 @@ func TestHandleUpdate_Document(t *testing.T) {
 	defer ts.Close()
 	bot := testBot(t, ts)
 	h := NewHandler(bot)
+	h.Config.AllowAllUsers = true // routing test
 
 	h.OnDocumentMessage = func(chatID int64, messageID int, fileID string, fileName string) (string, error) {
 		capturedFileID = fileID