Slack AI agent: give an AI agent scoped access to Slack with an approval gate
An external agent connected to Slack through UtilitySpaces' connector. 5 named tools, 1 write, every write stops for human approval.
Last updated
6 minute read · Written by the team that builds UtilitySpaces. More about UtilitySpaces.
A Slack AI agent is a named worker in your UtilitySpaces workspace that reads channels and messages in Slack and proposes changes — each write stopped by a person to approve before it reaches Slack. It connects through a Bot User OAuth Token (an API key you create in Slack), not scoped OAuth, so the blast radius is the credential and the fence is the approval gate on the one write.
What is a “Slack AI agent”?
A slack ai agent is a named worker in your UtilitySpaces workspace with a written brief, a set of tools, and a boundary. It connects to Slack through the UtilitySpaces Slack connector using a Bot User OAuth Token — an API key you create in Slack and paste in once — not scoped OAuth. The connector exposes five named tools: four reads and one write. The reads list conversations, read recent messages from a channel, list workspace users, and verify the token. The write posts a message as the bot. The four reads always run open. An agent can catch up on a noisy channel overnight, find the right person by listing users, or summarise a thread into the inbox, and none of that changes Slack. The single write — Post message — is dropped into the human approval gate before it leaves the connector; the agent cannot approve its own work, and each call is logged under the approver’s identity. The token is stored encrypted and bound to your workspace, never read back.
Why is Slack access different from OAuth apps?
Slack connects through an API key, not scoped OAuth. With an OAuth app like Microsoft Teams, the question is which Graph scopes you consent to — every scope is a named permission over live collaboration data, and the risk is bundling scopes on one identity. With Slack, there is one Bot User OAuth Token and all five tools hang off it, so the question is which writes you gate. The blast radius is the credential: if it leaks, the agent can read every channel it has been invited to and post as the bot. The fence is the approval gate, not scope. This is the API-key model shared with apps like Shopify and Stripe. For any key you hand over, keep writes behind the human approval gate and never let the agent copy the token out — keys are encrypted and bound to your workspace, and the bot never sees a raw credential.
Here is how the two connection models compare.
| Connection model | Where the fence is | Blast radius if the credential leaks | Read pattern |
|---|---|---|---|
| API key (Slack, Shopify, Stripe) | The approval gate on each write | The whole key — all reads and writes the key allows | Reads open, writes stopped |
| Scoped OAuth (Teams, Gmail) | The consented scopes per grant | Only the scopes you bundled on one identity | Reads open, writes stopped |
What tools does our Slack connector expose?
The tool list is generated from the Slack API surface the product runs on, so it cannot list a tool that does not exist. Here is every tool the connector exposes.
| Tool | What it does | Read or write | Stops for approval? |
|---|---|---|---|
| Test auth | Check the bot token and identify the workspace and bot user | Read | No |
| List conversations | List channels the bot can see | Read | No |
| Get conversation history | Read recent messages from a channel the bot is in | Read | No |
| List users | List members of the workspace | Read | No |
| Post message | Post a message to a channel as the bot | Write | Yes |
The four reads are always permitted — no gate, no extra grant. They let an agent summarise a channel’s recent history or find a workspace member by name, and they cannot post or invite anyone. Post message is the only write, and it stops at the approval gate before reaching Slack.
What does a Slack AI agent actually do?
Teams hand an agent the reading side of Slack first. Three jobs come up again and again.
Catch up on a busy channel overnight. An agent uses Get conversation history to read the last hundred messages in a channel the bot has been invited to, then writes a digest of decisions and action items back into the UtilitySpaces inbox instead of pinging the whole channel. The bot only sees channels it was added to, so the blast radius is bounded by membership, not by the key.
Find the right person for a question. A thread mentions a name or a title no one recognises, so the agent calls List users, matches the name against workspace members, and returns the right contact into the inbox thread — no guessing at spellings.
Post a status update on a schedule. A daily report or an incident note finishes in another flow, and the agent proposes a Post message to a status channel. The message lands in the approval queue first; nothing appears under the bot’s name until a person signs off.
The one hard constraint is visibility: the bot can only read channels it has been invited to, but a posted message is visible to everyone in that channel at once, so keep Post message on approval for any channel with clients or the whole company in it.
How do you connect an AI agent to Slack?
Start at the Slack integration and create a Bot User OAuth Token in your Slack workspace. A workspace owner pastes it once into the connection form; the field is Bot User OAuth Token. The token is encrypted and bound to your workspace, the agent never sees a raw token, the four reads stay open, and the one write is gated. Begin with reads only, confirm one channel summary in the inbox, then flip Post message to the gated option and watch the first proposals — not the writes — land in the approval queue.
Which write must always stop for human approval?
Posting a message is the only write, and it stays in the human approval gate until a person signs off. An agent cannot approve its own work; the gate is designed so a person reconstructs the message text from the proposal and signs it before it leaves the connector. Each call is logged under the approver’s identity in a hash-chained audit log, never as the agent. The four reads never stop, because a read cannot change Slack.
When should you not rely on this?
If your workspace expects the agent to post into the same private DMs a manager uses day to day, you are asking for impersonation risk — keep those writes human-first, or surface the thread and let a person reply. Slack is also a noisy app: an approval queue that stops every post turns a busy channel into a stack of proposals, so start with reads, add the one write, and treat this as human in the loop for AI agents — a boundary, not an afterthought. If you need a bot that posts instantly with no human in the loop, this is not it.
What are the limits?
The connector exposes exactly the five tools on the table above — generated from the Slack API surface, so it cannot list a tool that does not exist. A Slack agent reads only channels the bot has been invited to, lists users the bot can see, and posts as the bot user. It has no tools for managing workspace settings, installing apps, updating user roles, rotating tokens, or any other administrative action. The Bot User OAuth Token is a single credential, so the safety question is not “which scopes” but “which writes are gated” — and the only write, Post message, always needs a human in the approval queue. The trade-off is that the gate is always on for writes, and that is the point: if you need instant posting with no human in the loop, this is not it.
We build UtilitySpaces, a managed service for teams. It routes an AI agent to a runtime and a provider of your choice, but does not train or serve models. Slack connects through our connector, and every write is stopped by a human approval before it reaches Slack.
Keep reading
Shopify AI agent: give an AI agent scoped access to Shopify with an approval gate — Give a UtilitySpaces AI agent scoped access to a Shopify store through an encrypted API key. 5 named tools, 1 write, every write stops for human approval.
Asana AI agent: give an AI agent scoped access to Asana with an approval gate — An Asana AI agent is either Asana Intelligence or an external agent connected through an Asana API key with a human approval gate on every write.