How to roll out an AI agent in Slack safely
Roll out an AI agent in Slack by turning on app approval, installing one agent in one or two invited channels, connecting a single tool, and requiring a person to review anything that leaves the workspace. Do not start in #general with every integration enabled. Slack's own admin guidance is to require approval and to read the scopes before you click Allow. The rest is team habit: who can ask, what the agent may read, and what it must never do alone.
What should you decide before you install anything?
Write these down in a short Slack canvas or doc. If you cannot answer them, you are not ready to OAuth a Gmail account.
- The first job. One sentence: "Monday client brief from last week's Acme thread," not "help the team."
- The first channel. Prefer a private project channel or a dedicated #agent-pilot over #general.
- Who may ask. Named people for week one. Shared agents often accept @mentions from anyone in the channel.
- What "done" looks like. A draft in Slack that a human posts, or an action in another app? Those are different risk levels.
- What is out of bounds. Payroll, legal, HR, production credentials, and anything you would not paste into a vendor's prompt.
If the agent is personal (a Muse, a dot, an Instinct), it will not take orders from the rest of the team. Read personal vs shared before you buy five consumer seats and call it a rollout.
How do you review Slack app permissions?
Slack's article Security recommendations for approving apps is the baseline:
- Workspace Owners turn on Approve apps so members cannot install random agents.
- Read the scopes on the install screen. Posting, reading channel history, and acting as a user are different privileges.
- Ask whether the same job can be done with fewer scopes. Slack's developer guidance is least privilege.
- Check the vendor's security page and data-use statement. If they do not say whether they train on your messages, assume you need to ask.
- Assign an app manager so requests do not sit with one owner who is also running the company.
Geniusly's public security page currently says detailed security and privacy information will be published with the live product, and it does not claim compliance certifications. Treat that as a reason to start with read-only jobs and invited channels, not as a certificate. Lindy's pricing page states SOC 2 and GDPR. OpenTag's llms.txt states SOC 2 Type I as of 23 September 2026. Those are their claims, with their sources. Compare them; do not copy them onto a vendor that has not published the same thing.
Which channels should the agent join first?
Start narrower than feels polite.
- Week 1: one private channel with the people who asked for the agent, plus a DM for account connections.
- Week 2: the one client or ops channel where the first job actually happens.
- Not yet: #general, #random, shared channels with guests, or any channel that includes a customer unless the job is specifically a customer-facing draft you will send yourself.
Shared agents (Geniusly, OpenTag, Claude Tag) typically work in channels you invite them into. That is a feature. It is also how a poorly scoped bot reads a year of #leadership. Invite last, not first.
Geniusly account connections are set up in a private DM, not in the shared client channel. That keeps OAuth links out of the room with the contractor. See the Gmail guide and getting started.
How should tool connections and approvals work?
| Step | Do this | Do not do this |
|---|---|---|
| 1. Slack only | Install, invite one channel, ask for a recap of that channel | Connect Gmail on the same afternoon "while we are in settings" |
| 2. One read-only tool | Connect the account that holds the first job (often Gmail or Sheets) | Connect every tool on the integrations page |
| 3. Named-source asks | "Summarize the Acme thread from this week" | "Read my email and tell me what matters" |
| 4. Human send | Copy the draft; a person sends the email or posts the client update | Allow the agent to email customers on day one |
| 5. Writes, if ever | Turn on a single write (for Geniusly, an explicit Sheets edit) after the team has seen good drafts | Give CRM write access because the demo looked slick |
Geniusly is designed for that order: reads first, Sheets writes only when you ask, no Gmail send. Lindy's public FAQ says outbound actions wait for approval. OpenTag says it waits before it sends, spends, submits, or purchases. Slack's agent guidance for builders is the same idea: consequential actions need an explicit person. If a vendor cannot show you where that approval appears, do not connect a write scope.
Supported Geniusly tools are listed on /integrations. Jira, Salesforce, HubSpot, Stripe, and Confluence are still described as coming soon on the public pricing page, so do not plan a rollout that depends on them.
How do you run a one-week pilot?
- Monday: install with app approval on, join one channel, connect nothing else. Ask for a summary of that channel since last Friday. Check that the agent did not see other channels.
- Tuesday: connect one tool. Run one named-source task. Compare the output to the source. Write down every invented date or missing caveat.
- Wednesday: have a second person @mention the agent with the same ask. You are testing whether it is actually shared, and whether a second seat or credit charge appears.
- Thursday: produce the real artifact (brief, report, or handoff). A person posts or sends it. Time how long review took.
- Friday: decide expand, wait, or remove. Removal means uninstalling the Slack app and revoking the Google (or other) connection in the provider's account settings, not only leaving the channel.
If the first job is a weekly report, use the status-report guide as the script. If it is a handoff, use the handoff checklist. If it is Gmail, use Gmail thread to client brief.
What does a safe rollout checklist look like?
- Approve apps is on. One owner or app manager reviews scopes.
- The agent is in invited channels only. Not #general. Not guest channels yet.
- Account OAuth happens in a private DM, with a work account your admin allows.
- One tool connected. Named sources in every ask.
- No customer email or CRM write in week one.
- A person reviews facts before anything is forwarded.
- You know how to revoke Slack and the provider connection.
- You have written what the agent is for, and what it is not for, where the team can find it.
That list is enough for a five-person company. It is also the list a later security reviewer will wish you had kept.
Frequently asked questions
Can an AI agent read all of our Slack history?
Only if you grant history scopes and invite it into those channels. Start with one invited channel and read the install scopes. Slack does not make a third-party app omniscient by default.
Does Slack AI need this rollout?
Slack AI is built in on some paid plans and stays inside Slack. You still decide which paid plan you are on. A third-party coworker needs the approval and channel steps above because it leaves Slack for Gmail, Drive, or project tools.
Is Geniusly safe for client channels?
Geniusly prepares work for review and is read-only by default, except requested Sheets edits. The public security page does not claim certifications. Keep it in invited channels, name your sources, and have a person send client-facing email.
Should we connect Gmail with a shared inbox or a personal inbox?
Use the account that actually holds the threads for the first job, and only if your Google Workspace admin allows the app. A shared inbox can be the right source; it is also a wider blast radius. Start with one mailbox.
What is the fastest way to undo a rollout?
Remove the Slack app from the workspace, then revoke the third-party connection in Google (or the other provider) account settings. Leaving the Slack channel is not enough if the OAuth grant remains.