Keeping a smart lock safe - how do you handle it?

Configuration
1

Finally ready to get a smart lock for my front door and hesitating between Nimly Toucn Pro and Yale Doorman L3.

I want it integrated in Home Assiattn but, for security reasons, I don’t want Home Assistant to be able to unlock my door (only lock my door). But as I understand it that is not possible? How you found a way around it and/or how to you look at security between smart locks and Home Assistant?

2

Don’t give access to home assistant to people you do not trust. Problem solved.

3

I haven´t tried it myself with my Doorman but there is an verified unlock option in Yale settings which requires biometric or password authentication when unlocking the door remotely which should do the trick.

4

Thank you, but according to Gemini this setting only applies to the Yale app. When unlocking via Home Assistant this settings is not used.

Since you have the lock, would you mind posting a screenshot of the available sensors from the Yale lock?

5

I simply don’t see where what youbwant is going to be possible right now without significant customization and possibility code.

The Integration provides access to the door lock. If that’s ZWave or Zigbee they don’t use the consumer app to talk to the device AT ALL.. At which point you’re at the mercy of the system.

Thag means you fall into this category…

HA has no role based access control right now so that means There is no control in HA to prevent you from unlocking using the lock.unlock action

Which means if it can see it and lock it it can likely also unlock it.

Im ot going to try to allay your concern as a security person that’s not my job. I will say you can likely mitigate whatever yojr concern is another way.

In my case I don’t want voice agents able to unock or open a portal without prior auth. That means I had to write my own script and find a way to block the Default lock handing intent.

6

Thank you for your reply and confirming what I suspected. Is this script anything that can be shared for inspiration?

7

It’s not what you’re asking for exactly…

The 2026.9.0 beta (eta tomorrow) has a lock handler built in that requires a positive response to an auth request.

Yay cool! RBAC for a voice agent! Not so fast… To get it you need to build an auth system…

So I built a harness that lives inside HA that’s basically an os for Cognitive agents - that’s what that link is. That’s said it’s ALLLLL Jinja ha native so if you can read it knock yourself out. It’s MIT. The DojoTools Locks 1.3.0 or better is the script your looking for.

8

Can’t speak about ZWave, but I had a look at 2 random locks on the Z2M device database:

  • This one has finger_add & password_add actions, along with their not_match & open equivalents.
  • This one is even more involved, with per-user access settings & schedules.