diff --git a/src/discord/monitor/message-handler.preflight.ts b/src/discord/monitor/message-handler.preflight.ts
index 47f1e0c6d18..a7e7f04dfcb 100644
--- a/src/discord/monitor/message-handler.preflight.ts
+++ b/src/discord/monitor/message-handler.preflight.ts
@@ -39,6 +39,7 @@ import {
   resolveDiscordChannelConfigWithFallback,
   resolveDiscordGuildEntry,
   resolveDiscordShouldRequireMention,
+  resolveDiscordRoleAllowed,
   resolveDiscordUserAllowed,
   resolveGroupDmAllow,
 } from "./allow-list.js";
@@ -220,12 +221,14 @@ export async function preflightDiscordMessage(
   }
 
   // Fresh config for bindings lookup; other routing inputs are payload-derived.
-  const memberRoleIds = params.data.member?.roles?.map((r: { id: string }) => r.id) ?? [];
+  // member.roles is already string[] (Snowflake IDs) per Discord API types
+  const memberRoleIds: string[] = params.data.member?.roles ?? [];
   const route = resolveAgentRoute({
     cfg: loadConfig(),
     channel: "discord",
     accountId: params.accountId,
     guildId: params.data.guild_id ?? undefined,
+    memberRoleIds,
     peer: {
       kind: isDirectMessage ? "direct" : isGroupDm ? "group" : "channel",
       id: isDirectMessage ? author.id : message.channelId,
@@ -535,15 +538,30 @@ export async function preflightDiscordMessage(
 
   if (isGuildMessage) {
     const channelUsers = channelConfig?.users ?? guildInfo?.users;
-    if (Array.isArray(channelUsers) && channelUsers.length > 0) {
-      const userOk = resolveDiscordUserAllowed({
-        allowList: channelUsers,
-        userId: sender.id,
-        userName: sender.name,
-        userTag: sender.tag,
-      });
-      if (!userOk) {
-        logVerbose(`Blocked discord guild sender ${sender.id} (not in channel users allowlist)`);
+    const channelRoles = channelConfig?.roles ?? guildInfo?.roles;
+    const hasUserRestriction = Array.isArray(channelUsers) && channelUsers.length > 0;
+    const hasRoleRestriction = Array.isArray(channelRoles) && channelRoles.length > 0;
+
+    if (hasUserRestriction || hasRoleRestriction) {
+      // member.roles is already string[] (Snowflake IDs) per Discord API types
+      const memberRoleIds: string[] = params.data.member?.roles ?? [];
+      const userOk = hasUserRestriction
+        ? resolveDiscordUserAllowed({
+            allowList: channelUsers,
+            userId: sender.id,
+            userName: sender.name,
+            userTag: sender.tag,
+          })
+        : false;
+      const roleOk = hasRoleRestriction
+        ? resolveDiscordRoleAllowed({
+            allowList: channelRoles,
+            memberRoleIds,
+          })
+        : false;
+
+      if (!userOk && !roleOk) {
+        logVerbose(`Blocked discord guild sender ${sender.id} (not in users/roles allowlist)`);
         return null;
       }
     }