Slack Connector Setup & RBAC

The Slack MCP connector allows AI agents to read channel history, post messages, and scan threads within designated compliance boundaries — with human-in-the-loop gates for destructive or public-facing write actions.

Setup Variables

• Workspace ID: Your Slack team ID (found in workspace settings).
• OAuth Scopes: Standard permissions such as chat:write and channels:read.
• Credential Vault Reference: Slack Bot OAuth token stored securely inside the MakeYourMCP vault — never exposed to the LLM context.

Why Slack Needs RBAC in AI Agent Pipelines

Slack integrations are among the highest-risk connectors for AI agents because write access can have immediate real-world consequences: an agent posting incorrect information to a customer-facing channel, sending an internal message to the wrong audience, or flooding channels with automated noise. Additionally, Slack channels often contain confidential deal discussions, HR conversations, and engineering secrets that agents should never be able to read without a scoped role. MakeYourMCP enforces channel-level read/write boundaries and routes write actions through approval gates before any message is posted.

Example RBAC Policy

version: "mcp/v1alpha1"
metadata:
  id: "policy_slack_support_agent"
  name: "Support Agent — Read + Gated Write"

rules:
  - id: "rule_slack_read_support_channels"
    role: "support_agent"
    resource: "slack_workspace.channel.support-*"
    actions:
      - "read"
    approval:
      required: false

  - id: "rule_slack_write_gated"
    role: "support_agent"
    resource: "slack_workspace.channel.support-general"
    actions:
      - "write"
    approval:
      required: true
      approvers:
        - "support_team_lead"
      timeout_minutes: 15

  - id: "rule_block_private_channels"
    role: "support_agent"
    resource: "slack_workspace.channel.#private-*"
    actions:
      - "*"
    effect: "deny"

Common Pitfalls

• No approval gate on write actions: Agents with unrestricted chat:write access can post messages autonomously, which is a compliance and reputational risk. Always require human approval for agent-initiated Slack posts in production workspaces.
• Over-broad channel wildcard in read scope: Granting read access to * exposes private and HR channels to the agent. Always explicitly scope to the channels the agent legitimately needs (e.g. support-*).
• Not setting an approval timeout: Without a timeout_minutes setting, a pending approval can block an agent workflow indefinitely. Set a timeout that auto-denies after a reasonable window to keep pipelines healthy.

See Also

• PostgreSQL Connector Setup Guide — database access for data-driven agents
• Snowflake Connector Setup Guide — analytical warehouse access
• Salesforce Connector Setup Guide — CRM data paired with Slack notifications
• GitHub Connector Setup Guide — engineering agents with Slack alerting
• Policy YAML Schema Reference — full policy declaration specification
• Full Documentation Index
• Understanding RBAC in MCP Gateways — channel-level authorization deep dive
• MakeYourMCP Security & Trust Center — full security architecture overview

← Back to documentation index