Documentation / Integrations / Slack

Slack security and permissions

This document describes how Rebyte authorizes Slack requests, routes messages to Agent Computers, selects connector credentials, and determines who can see the resulting task and output.

Current implementation•Last reviewed July 20, 2026

Scope

Slack and Rebyte maintain separate authorization systems. Rebyte evaluates the Slack installation, Slack conversation, Rebyte identity, Agent Computer visibility, and connector credential for each request. Access in one system does not imply access in another.

Documentation statusThis page records current product behavior. It is not a certification, compliance report, or guarantee that every Slack and Rebyte audience is identical.

Authorization layers

A Slack request crosses four independently managed layers.

Slack installation: Controlled by Rebyte organization adminConnects one Rebyte organization to one Slack workspace and grants the Rebyte bot its Slack scopes.
Slack conversation: Controlled by SlackChannel membership decides who can see and send Slack messages. App presence decides which conversations Slack exposes to Rebyte.
Rebyte Agent Computer: Controlled by Rebyte workspace ownerPrivate, Shared, or Public visibility decides who can open the Agent and every task, file, artifact, and conversation inside it.
Connected account: Controlled by A person or the organizationThe sender’s identity and the connector’s scope decide which external account an Agent can use for a tool call.

Message routing

Rebyte responds to direct messages and direct @Rebyte mentions. The root Slack message determines the task route for the rest of that thread.

Slack entry	Task destination	Who can start / follow up	Result visibility
Direct message	New private Agent task	Start: The confirmed Slack sender Follow up: That same sender	Slack: Visible in the DM Rebyte: Private to the sender
Unbound internal channel	New private Global task	Start: The confirmed sender who mentions @Rebyte Follow up: Only the original sender	Slack: Visible to the Slack channel Rebyte: Private to the original sender
Bound internal channel	Task in the bound Agent Computer	Start: Eligible full members who mention @Rebyte Follow up: Eligible full members in the task thread	Slack: Visible to the Slack channel Rebyte: Inherits the bound Agent’s visibility
Slack Connect / shared channel	Not supported	Start: No one Follow up: No one	Slack: No Agent work is started Rebyte: No task is created

App membership and channel binding are different. Membership lets Slack deliver channel events to Rebyte. A binding changes the Agent Computer in which a new task is created.

Agent Computer visibility

Tasks do not have an independent ACL. Conversations, files, artifacts, the cloud computer, and tasks inherit the Agent Computer visibility setting.

Visibility	Who can open it	Who can act	Slack compatibility
Private	Owner and individually granted ACL members	Owner and ACL members are editors	DM and unbound-channel Global tasks use this. A bound channel cannot run a Private Agent.
Shared	Every member of the Rebyte organization	Organization members are editors	Supported for bound internal Slack channels
Public	Anyone with a link can view; Rebyte org members can edit	Anonymous visitors are read-only	Supported for bound channels, but the Rebyte task remains publicly viewable by link

Identity provisioning

Rebyte resolves a canonical user before starting Agent work. There is no separate manual account-linking step for an eligible Slack member.

Confirmed email is the identity key

On the first actionable message, Rebyte reads the Slack user’s confirmed email and matches it to one verified primary Rebyte email.

Slack can provision Rebyte membership

An eligible full member is created or matched in Rebyte, added to the connected Rebyte organization, and then bound to that Slack identity.

Guests and external people are blocked

Slack guests, Slack Connect users, bots, deleted users, banned Rebyte users, and ambiguous or unverified email matches cannot start work.

Each prompt keeps its sender

A follow-up from another eligible member runs as that member. This is what keeps personal connector selection tied to the person taking the action.

RevocationRemoving only the Rebyte organization membership is not durable Slack revocation. An otherwise eligible full Slack member can be provisioned again on a later message. For persistent revocation, disable or remove the person in Slack, ban the Rebyte identity, remove app access, or disconnect the integration.

Connector credentials

The Agent Computer determines which tools are installed. The connector mode and current Slack sender determine which external account is used for a tool call.

Personal-capable connector

Use the current Slack sender’s personal account when connected
Otherwise fall back to the organization account when one exists
Otherwise stop the tool call until an appropriate connection exists

Organization-only connector

Use the organization account configured by an admin
Never substitute another person’s personal account
Stop the tool call when the organization account is unavailable

Credential ownership and output visibilityCredentials remain attached to their person or organization. Output does not inherit the credential’s privacy: messages, files, and artifacts are written to the task and Slack thread and follow those destinations’ audiences.

Administration and lifecycle

Slack installation and channel routing are organization-level administrative operations.

Administrative controls

Only Rebyte organization admins can install, switch, or disconnect a Slack workspace and create or remove channel bindings.
An admin can explicitly confirm a one-time join of existing eligible public channels. Private and Slack Connect channels are excluded.
Binding is one-to-one: one Slack channel routes to one Agent Computer, and one Agent Computer routes to one Slack channel.
A public channel is joined when it is explicitly bound. A private channel must already contain the Rebyte app.
Disconnecting Slack revokes the bot token and removes the installation, channel bindings, user bindings, and Slack task-thread routes.

Implementation safeguards

Slack event and interaction signatures are verified, and stale signed requests are rejected.
The installation uses an organization bot token, not individual Slack user OAuth tokens.
The bot token and pending installation credentials are encrypted at rest.
Inbound events and outbound Slack side effects use durable, idempotent workflows with installation fences.
Referenced Slack context is marked as untrusted source material before it is added to an Agent prompt.
File downloads are restricted to trusted Slack HTTPS hosts and bounded by count, size, and timeout limits.

Slack OAuth scopes

Rebyte installs one organization bot token. The following inventory groups the current bot scopes by purpose.

Identity and workspaceVerify the Slack workspace and resolve confirmed human identities.

team:readusers:readusers:read.email

Conversations and contextDiscover eligible channels and read messages in conversations where the app is present or explicitly given context.

channels:readchannels:historygroups:readgroups:historyim:readim:historympim:readmpim:historylinks:read

Presence and deliveryJoin eligible public channels, send replies and progress, add reactions, and deliver files or Slack work surfaces.

channels:joinchannels:managegroups:writeim:writempim:writechat:writechat:write.customizereactions:readreactions:writefiles:readfiles:writelinks:writeassistant:writebookmarks:readbookmarks:writecanvases:readcanvases:writelists:readlists:write

Scope availability describes the app’s technical capability. Actual message and file access still depends on Slack delivering the conversation to the app.

Constraints to understand

These boundaries are intentional or current product behavior and should be considered when choosing a channel and Agent Computer.

Private Slack is not a Rebyte ACL: Binding a private Slack channel to a Shared Agent means all Rebyte organization members can open the Agent’s tasks, even if they are not members of that private Slack channel.
Public Rebyte stays public: A task in a Public Agent remains readable by anyone with its Rebyte link, even when the Slack conversation itself is private or internal.
Private credentials can produce shared output: A personal connector token is not shared with teammates, but the messages, files, and artifacts produced through it inherit the task and Slack thread audiences.
Unbinding does not remove the app: Unbind removes the one-to-one Agent routing record. Rebyte remains a member of the Slack channel until a Slack admin or member removes it there.

← Rebyte for Slack overview