diff --git a/src/channel.ts b/src/channel.ts
index d5fd3cb..80fe138 100644
--- a/src/channel.ts
+++ b/src/channel.ts
@@ -120,6 +120,19 @@ export const qqbotPlugin: ChannelPlugin<ResolvedQQBotAccount> = {
       configured: Boolean(account?.appId && account?.clientSecret),
       tokenSource: account?.secretSource,
     }),
+    // 关键：解析 allowFrom 配置，用于命令授权
+    resolveAllowFrom: ({ cfg, accountId }: { cfg: OpenClawConfig; accountId?: string }) => {
+      const account = resolveQQBotAccount(cfg, accountId);
+      const allowFrom = account.config?.allowFrom ?? [];
+      return allowFrom.map((entry: string | number) => String(entry));
+    },
+    // 格式化 allowFrom 条目（移除 qqbot: 前缀，统一大写）
+    formatAllowFrom: ({ allowFrom }: { allowFrom: Array<string | number> }) =>
+      allowFrom
+        .map((entry: string | number) => String(entry).trim())
+        .filter(Boolean)
+        .map((entry: string) => entry.replace(/^qqbot:/i, ""))
+        .map((entry: string) => entry.toUpperCase()), // QQ openid 是大写的
   },
   setup: {
     // 新增：规范化账户 ID
diff --git a/src/onboarding.ts b/src/onboarding.ts
index f634b5e..36df224 100644
--- a/src/onboarding.ts
+++ b/src/onboarding.ts
@@ -21,6 +21,7 @@ interface QQBotChannelConfig {
   clientSecretFile?: string;
   name?: string;
   imageServerBaseUrl?: string;
+  allowFrom?: string[];
   accounts?: Record<string, {
     enabled?: boolean;
     appId?: string;
@@ -28,6 +29,7 @@ interface QQBotChannelConfig {
     clientSecretFile?: string;
     name?: string;
     imageServerBaseUrl?: string;
+    allowFrom?: string[];
   }>;
 }
 
@@ -137,6 +139,7 @@ statusLines: [`QQ Bot: ${configured ? "已配置" : "需要 AppID 和 ClientSecr
             qqbot: {
               ...(next.channels?.qqbot as Record<string, unknown> || {}),
               enabled: true,
+              allowFrom: resolvedAccount.config?.allowFrom ?? ["*"],
             },
           },
         };
@@ -200,6 +203,9 @@ statusLines: [`QQ Bot: ${configured ? "已配置" : "需要 AppID 和 ClientSecr
       ).trim();
     }
 
+    // 默认允许所有人执行命令（用户无感知）
+    const allowFrom: string[] = resolvedAccount.config?.allowFrom ?? ["*"];
+
     // 应用配置
     if (appId && clientSecret) {
       if (accountId === DEFAULT_ACCOUNT_ID) {
@@ -212,6 +218,7 @@ statusLines: [`QQ Bot: ${configured ? "已配置" : "需要 AppID 和 ClientSecr
               enabled: true,
               appId,
               clientSecret,
+              allowFrom,
             },
           },
         };
@@ -230,6 +237,7 @@ statusLines: [`QQ Bot: ${configured ? "已配置" : "需要 AppID 和 ClientSecr
                   enabled: true,
                   appId,
                   clientSecret,
+                  allowFrom,
                 },
               },
             },