Back to Blog

AstrBot / Home Assistant / IoT

Permissions and Audit Design for Home Assistant Control in AstrBot

A device catalog, permission, and audit model for smart-home control through chat.

When a chat bot controls smart-home devices, the core design issue is the permission boundary. Natural-language control is convenient, but device state, service calls, and message sources need explicit records.

Project Overview

main.py handles /ha and /ha_ping. The home_assistant_control package separates the client, configuration, permissions, entity catalog, alias matching, natural-language routing, service routing, audit, and trace modules.

The plugin lets AstrBot query and control Home Assistant entities with limits. It fits status checks, low-risk light control, and audited smart-home operations.

Implementation

At startup, the plugin fetches entities and builds a local catalog with entity IDs, display names, domains, services, and aliases. Input is first matched against devices and actions, then converted to a service call.

Rules handle common operations. LLM interpretation is only a fallback, and its output still passes permission profiles and service allow lists before execution.