By default only the owner is answered. You can allow more people. They still must DM the bot privately. A group uses a separate allow list. A private grant does not put someone in a group, and a group member does not get a private chat. See Group chats. 
telekit access list
telekit access add-user <telegram_id> --label "collab" --node project --thread default
telekit access grant <telegram_id> <node> --thread default
telekit access revoke <telegram_id> <node>
--profile scopes the grant to one bot.

​
Pause one user’s access

Telegram member access is always enabled. Each grant still limits what that person can reach. Grant only people you trust: each active member drives a full-tool agent in their nodes. Pause or resume one user on one bot without removing their saved grants: 
telekit bot-users set-enabled --profile P --user ID --mode off
telekit bot-users set-enabled --profile P --user ID --mode on
Paused users stay in the list. The bot silently ignores their private and group messages. Pending work cannot send further replies after the pause succeeds. Resume restores the saved scope, but does not revive old pending replies or CLI sends from a revoked turn. This works for owners too. A global account disable takes precedence and cannot be undone with this switch. The bot’s Pause control affects the whole bot. Resuming the bot leaves individually paused users paused. Adding a person does not resume anyone else. Older installations with members intentionally paused keep those people paused when upgraded. The old access multi-user off and bot-users members --mode off commands return an error and direct you to individual access controls. They see only granted nodes. Paths are hidden from members. An ungranted /node payroll reads as “no such node” — telekit does not confirm that the node exists. Thread grants: omit for default, or list slugs, or * for all. /whoami prints the numeric id to give the owner.

​
Detect and manage users for one bot

The bot-users commands return JSON. Every command requires --profile P to choose the bot. Discovery uses the running bridge. It does not start a second inbox reader or restart the bridge.
CommandWhat it does
telekit bot-users capability --profile PCheck that the live bridge supports user management.
telekit bot-users list --profile PList effective users, roles, access states, individual access states and available nodes.
telekit bot-users begin --profile PStart a two-minute discovery session and return its session ID.
telekit bot-users status --profile P --session SRead the session state and detected accounts.
telekit bot-users cancel --profile P --session SEnd this session without adding anyone.
telekit bot-users confirm --profile P --session S --user ID --node NODEAdd the detected account as a member in the selected node. Repeat --node for more nodes.
telekit bot-users remove --profile P --user IDRemove this account’s private and group access on this bot.
telekit bot-users set-enabled --profile P --user ID --mode on|offResume or pause this user on this bot.
telekit bot-users confirm --profile P --session S --user ID --all-nodesGive the detected member access to All nodes.
After begin, read status until ready is true. Then ask the person to send a fresh private message to the selected bot. Read status again and check their displayed name, username, and numeric sender ID. Choose that exact account with confirm. No node is granted until confirmation succeeds. Members get the default thread in each chosen node. Their next message can start a turn without restarting the bridge. Discovery never treats the message text or a forwarded sender as the account to add. Old messages, edits, group messages, and bot senders do not qualify. More than one sender can appear. Already added or disabled accounts cannot be added through this flow. Cancel or expiry clears candidate details. Authorized chats continue while discovery is open. Results use this shape: 
{"contract_version":2,"ok":true,"code":"ok","message":"","data":{"user_id":"67890","profile":"example"}}
Check ok and the process exit code. A failure returns ok: false, a stable code, a readable message, and data: null. Offline, polling conflict, expired session, incompatible bridge, and save errors require recovery or retry. A bot identity change invalidates discovery. Start a new session after the correct bridge is running. All nodes includes current and future routable nodes in the same home. It excludes nodes shared by other accounts. It grants member access and the default thread, with no administration rights. Connect a node home before granting All nodes. You can confirm it when that home has no current eligible nodes. For a selected subset, omit --all-nodes and specify at least one --node. Never combine these modes. A home change clears All nodes with existing named-node grants. Capability distinguishes discovery readiness from support for individual switches and All nodes. An older running bridge must be updated before these controls can write. A stopped bridge permits local pause/resume recovery; discovery still requires a running bridge. Successful confirmation retries return the saved result for ten minutes. They require the same account and node selection. They do not add the person again after removal or resume a paused user. Removal takes effect for the chosen bot only. Future messages and pending replies lose access; saved conversations and access on other bots stay. It cannot undo a tool action or message completed before removal. Owners can also be removed from one bot. The default owner’s removal stays effective after restart. Adding that account later with this flow gives it member access, not owner access. Usernames are display information; the numeric Telegram ID controls access.