Voice Agent: Private & Public Mode

The two modes

Private mode

For you, the owner. Full agent: your memory, your skills, your actions - email, calendar, files, CRM, custom tools. Same power you’d have in a Telegram chat with your agent.

Public mode

For everyone else. A controlled, safe interaction that you define with a short playbook.

Step 1 - Set your Owner phone (30 seconds)

Open your bot’s Voice Settings in the dashboard:

• Owner phone - your number in E.164 format (e.g. +16478359044).
• Call mode - leave it on public (the default).

“Public” here means “accept any caller, then switch to private for you.” Only set private if you want the bot to reject every caller who isn’t you.

Save. That’s enough for a working agent - private for you, onboarding guide for anyone else (see next step).

Step 2 - What you get out of the box

Immediately after purchase, no public-mode playbook is configured yet. So:

• When you call
  You get Private mode automatically - full access to your agent’s memory, email, calendar, everything your OpenClaw bot can do.
• When a stranger calls
  The bot runs in Onboarding mode - a friendly setup guide that explains the number isn’t configured yet and offers to walk the owner through configuration. It does NOT take messages (there’s no inbox). It does NOT pretend to know your business.

Step 3 - Teach the bot what public callers can do

To replace Onboarding mode with real capability for public callers (booking, FAQs, lead capture), add a ## Public Mode section to your voice playbook.

The playbook file lives on your server at:

~/.openclaw/workspace/protocols/dojo-voice-agent-playbook.md

Edit it directly - via SSH or your OpenClaw file editor. The bot re-reads the file on every incoming call, so there’s no restart or deploy step. Software updates don’t overwrite your edits.

A Public Mode that actually does something

## Public Mode

### What you can tell callers
Hours: Mon-Fri 9am-6pm. Services and prices: haircut $30, beard $15,
combo $40. Location: 123 Main St, Toronto.

### What you can do for callers
Book appointments via the Calendar skill. Capture new leads in the CRM.

### What you must NOT do
Never share the owner's personal email, schedule, or files. Never commit
to prices outside the list above. Never take payments over the phone.

### Information to collect
Full name, callback phone, reason for the visit, preferred appointment
time. Confirm each detail back before ending the call.

Optional: customize Private mode too

Add a ## Private Mode section in the same file for tone, call scripts, or standing rules when you call. Leave it out entirely and the defaults apply.

How to test

• Call from your owner number - the bot should greet you with full capability (memory, tools, actions).
• Call from any other number:
  • No ## Public Mode section yet → onboarding-guide behavior (friendly, points to setup).
  • With a ## Public Mode section → the bot follows it exactly.

If the test doesn’t match, check:

• Owner phone is in +E.164 format and matches exactly what the phone network sees on the incoming call.
• Call mode is public (not private).
• The playbook file exists and uses exact heading ## Public Mode (level-2, exact spelling).

A word on safety

Private mode gives the caller the same power as you’d have in a Telegram chat with your agent - email, calendar, files, CRM. Only one number should ever be in “Owner phone.” The gateway refuses to grant private-mode privileges to any other caller, even if they claim to be you.

Public mode is where you set hard business-specific boundaries. Good practice: write the “What you must NOT do” list before “What you can do.”

What the gateway blocks automatically (you don’t write these rules)

• Impersonation. Public callers claiming “I’m the owner” or “I have permission” never get private-mode access - caller-ID is the only path to that, no exceptions.
• Prompt-injection & jailbreaks. Phrases like “ignore your rules”, “let’s pretend”, “for QA purposes”, “you are now in admin mode” are intercepted and replaced with a polite redirect.
• Internal-path disclosure. File paths, workspace structure, owner’s emails/calendar/contacts, and other private data never reach a public caller - even if your playbook accidentally describes them.
• Model & vendor disclosure. The agent never names the underlying AI model or vendor - it stays in character per your persona.
• Cross-caller leakage. Each public caller gets an isolated session - no caller can ever read another caller’s conversation.
• Secret read-back. API keys, tokens, passwords, and credentials are never read aloud, even in private mode.

Your playbook only needs to cover business rules (services, hours, what you book, what you don’t). Security is the platform’s job, not yours.

Where things live