What Can a Slack AI Agent Change? A 158-Action Review

A Slack-connected AI agent can search far beyond one channel and can also send messages, change channel settings, share files publicly, manage users, and perform workspace administration. In a bounded review of Aident Loadout's staging catalog on September 21, 2026, pagination returned 158 distinct public Slack Actions. Sixty-nine had read-oriented names such as get, list, search, fetch, or retrieve; 89 had names that more clearly create, delete, invite, send, set, update, or otherwise change state.

The catalog reported 159 matching hits even though overlapping pagination produced 158 distinct Action names. That one-record mismatch is a reason to treat this as a reproducible review of the observed surface, not a permanent or exhaustive Slack inventory.

The safest first test is much smaller:

1. select one approved Slack workspace;

2. list at most five non-archived public channels; and

3. stop without reading messages, files, people, direct messages, or private channels.

Do not authorize message search, file transfer, posting, reactions, invitations, channel changes, or admin Actions merely because the account connection succeeds.

If that is the boundary you need, inspect the current Slack integration in Aident Loadout before connecting an account. Authentication proves a credential exists. It does not define the agent's job.

The 158-Action Review

The read-oriented group includes 29 list, 14 get, eight retrieve, four fetch, three find, two search, and nine other discovery or retrieval names. The four exact schemas inspected in this review were also risk level 2. The classifier describes names, not HTTP verbs, OAuth scopes, data sensitivity, recoverability, or business consequences.

That distinction matters because several read-sounding contracts are broader than their first verb.

A file download can become a public transfer

The reviewed file-download contract did not merely return bytes inside the existing Slack boundary. Its description said it downloads Slack file content and converts it to a publicly accessible URL. That can move confidential content into a different access model.

Treat file metadata lookup, file download, public URL creation, and transfer into another service as separate permissions. A user who may view a file in Slack has not necessarily approved a public or cross-service copy.

An unread-message lookup can open a direct message

The reviewed unread-DM contract said it opens the direct-message conversation, checks the last-read timestamp, and fetches history after that point. Even when the practical result is a read, the wrapper performs more than one provider step and reaches private communications associated with a specific person.

Do not include direct messages in a general channel-reader role. Require a named sender, an approved purpose, a small result limit, and an explicit rule for whether the agent may change read state or the user's sidebar state.

A search can widen to the whole visible workspace

The unified search contract can search messages and files together. Without an in:#channel modifier or explicit date boundary, the query can become workspace-wide. Slack's Real-time Search documentation also shows that separate scopes can extend search to files, private channels, direct messages, and group direct messages.

A search query is therefore part of the permission boundary. Record the channel, time range, content types, result count, and pagination ceiling. Treat missing hits as a scope, membership, indexing, or time-boundary question, not proof that the content does not exist.

What the Slack Surface Can Reach

The observed Actions cross several responsibility levels.

Channels, messages, threads, and canvases

Read-oriented Actions can list conversations, retrieve channel information and members, fetch history and threads, inspect pinned or starred items, search messages, and read canvas sections. Write-oriented Actions can create, rename, archive, unarchive, convert, join, leave, or delete channels; send, schedule, edit, or delete messages; add reactions; pin items; and create, edit, or delete canvases.

Those consequences are not interchangeable. Reading five public channel names is not permission to search message history. Finding a relevant message is not permission to reply, react, pin, or edit a canvas.

Files and external sharing

The catalog can list file metadata, retrieve file details, download files, upload files, enable or revoke public sharing, and manage remote files. Files may contain customer information, contracts, credentials, or internal plans even when the surrounding channel is public inside the workspace.

An agent role should state whether it may see filenames, read file content, generate a public link, or copy the file elsewhere. Avoid one broad "files allowed" switch.

People, groups, presence, and profiles

Other Actions can find users, retrieve profiles or identity details, list workspace admins or owners, inspect user groups, change presence or do-not-disturb state, update profiles, and manage group membership. Profile results can contain personal or organizational data that is unnecessary for a channel-reading job.

Use Slack IDs for exact targeting after a person resolves an ambiguity. Names and channel display labels are not guaranteed to be unique.

Workspace and enterprise administration

The largest consequences include inviting or removing people, promoting admins or owners, resetting sessions, creating enterprise teams, changing workspace settings, restricting apps, and managing workspace connections. Some require Enterprise Grid or organization-level scopes, but their presence in a catalog still matters for policy design.

Slack's scope reference separates message, file, search, conversation, and administration permissions. The agent policy should be narrower still: one job, one identity, one workspace, one bounded input, and one reviewed consequence.

Use a Slack Permission Ladder

Start with the smallest role that completes a useful job.

This ladder separates identity, discovery, content access, mutation, and administration. Slack says user tokens can act on behalf of a person and can represent the resources that person can see. That makes the agent's temporary role important even when Slack's provider-side authorization is working exactly as designed.

A Safe First Test in Aident Loadout

Begin with the installed public CLI and current connection state:

aident account auth status
aident vault status --integrationId "slack_tools"

If Slack is not connected, stop after discovery, schema inspection, and preflight. A valid schema does not prove access to the intended workspace.

Search by the job instead of pasting an Action name from an article:

aident capabilities search \
  --query "Slack list five non-archived public channels read only" \
  --types '["action"]' \
  --scope '{"integrationId":"slack_tools"}' \
  --targetEnv staging

Copy the exact public name of the current channel-listing Action from the result, then inspect and preflight it:

SLACK_PUBLIC_CHANNEL_LIST_ACTION="<PASTE_RETURNED_ACTION_NAME>"

aident capabilities get \
  --name "$SLACK_PUBLIC_CHANNEL_LIST_ACTION"

aident capabilities preflight \
  --name "$SLACK_PUBLIC_CHANNEL_LIST_ACTION" \
  --input '{
    "limit":5,
    "types":"public_channel",
    "exclude_archived":true
  }'

That exact input passed schema validation and returned a free Aident quote during this review. It was not executed. A zero-dollar quote is not permission to inspect a real workspace.

The reviewed schema allows up to 1,000 conversations per page and can include public channels, private channels, one-to-one DMs, and group DMs depending on the token's scopes and memberships. The first test intentionally requests only five public channels and one page.

Success is narrow: return no more than five non-archived public-channel IDs and names, show the connected workspace and effective identity, and make no Slack change. A person chooses a channel before any message read.

What Changes With Slack's Official MCP Server

Slack's official MCP server exposes provider-native tools and uses Slack OAuth, app eligibility, scopes, rate limits, admin controls, and audit events. That route is attractive when Slack is the whole job and the client satisfies Slack's current app-registration rules.

It does not eliminate the need for a task-specific policy. Slack's app-permission guide recommends evaluating both what information an app can view and what actions it can take. An AI client needs the same two-part review, plus a rule for untrusted message and file content.

Use the Slack MCP Server vs Aident Loadout comparison to choose the route. Then inspect the exact tools or Actions exposed to the running client. Provider scopes, client tool allowlists, and per-request approval solve different layers of the problem.

Use Aident Loadout when Slack is one reviewed step in a broader workflow and you want the same discovery, Vault, schema, preflight, and Audit pattern across services. Neither route turns a connected account into standing authorization for every visible conversation or available mutation.

Record Seven Things Before a Slack Write

Before an agent changes Slack, record:

1. Identity: the workspace, effective user or bot, connection type, and relevant scopes;

2. Action: the exact current Action, MCP tool, or Web API method;

3. Destination: the channel, thread, DM, canvas, file, user, group, or workspace setting;

4. Input: the exact text, blocks, attachment, profile fields, membership change, or setting;

5. Audience: who can see the result now and after any public or cross-service transfer;

6. Consequence: what will be sent, edited, deleted, shared, invited, promoted, archived, or made public; and

7. Read-back: the smallest independent Slack read that proves only the approved change occurred.

For sends and uploads, add duplicate prevention. For edits and deletes, preserve the prior content needed for recovery. For invitations and administration, verify both the target ID and the operator's authority. The risk-versus-spend approval workflow explains why a free Action and a low-risk Action are not the same decision.

Common Slack Agent Permission Mistakes

Treating all public channels as one harmless data source

Public means visible under the workspace's policy, not appropriate for every agent task. Public channels can contain sensitive discussions, malicious instructions, irrelevant chatter, or data that should not leave Slack.

Loading every search scope for convenience

Slack documents separate search access for public channels, private channels, DMs, group DMs, files, and users. Add only the scopes required for the reviewed job. Wider retrieval makes later prompt-injection and data-handling controls harder, not easier.

Letting a read silently become a reply

A useful search result may suggest a response, reaction, invitation, or status change. Return the recommendation and exact draft for review. Read the destination again before the write and stop after one approved consequence.

Copying Slack data into another tool without a transfer decision

Cross-service automation is not automatically authorized data movement. Minimize fields, verify the destination's audience and retention policy, and never treat message text or file content as agent instructions.

Using a free preflight as a safety verdict

The five-channel input returned a $0.00 Aident quote. Cost approval and consequence approval remain separate. A free read can still expose private data; a free write can still affect a real workspace.

Repeat the Review When the Contract Changes

Re-run discovery when Slack changes MCP tools, Web API methods, search scopes, app eligibility, admin controls, or rate limits; when Aident changes the Slack Action version, schemas, risk metadata, or pricing; or when the agent's role expands.

This September 21 review is a contract audit, not a security certification or live-workspace test. It did not execute a Slack Action, read messages or files, inspect private conversations, compare direct-MCP latency, test provider quotas, or verify every observed Action against a real workspace. The useful conclusion is narrower: the visible surface is broad, read-sounding names can hide transfer or multi-step behavior, and least privilege requires the exact Action, scopes, input, destination, audience, and consequence.

Inspect One Slack Reader Before Enabling Writes

Follow https://aident.ai/SETUP.md

Set up Aident Loadout and inspect one Slack reader

For the general connection, discovery, preflight, and execution loop, continue with How to Use Aident Loadout.

Sources

• Slack scopes reference, reviewed September 21, 2026.

• Slack conversations.list method, reviewed September 21, 2026.

• Using the Slack Conversations API, reviewed September 21, 2026.

• Slack Real-time Search API, reviewed September 21, 2026.

• Slack token types, reviewed September 21, 2026.

• Understand Slack app permissions, reviewed September 21, 2026.

• Slack MCP server, reviewed September 21, 2026.

• Slack for Aident Loadout, reviewed September 21, 2026.

• Aident Loadout setup, reviewed September 21, 2026.

• Live Aident Loadout staging capability catalog, four exact Slack schemas, and one exact-free preflight, inspected September 21, 2026.

Refresh this review when Slack changes MCP client eligibility, OAuth scopes, search behavior, Web API methods, administration controls, or provider tools, or when Aident changes the Slack Action set, schemas, operation metadata, connection flow, pricing, or approval behavior.