AI agent Slack announcement policy

The control gap

A message to a broad channel is an organizational action, even when the text was generated from accurate source material.

Channel reach and membership determine the risk of a Slack post. Policy should distinguish a private working channel from a company-wide announcement, a shared external channel, or a channel bridged into an incident system. Mentions such as @channel and @here can raise impact even when the destination itself is normally approved.

Give the reviewer the rendered text, links, files, target channel, and estimated audience. Approval should be invalidated if any of them change. After execution, retain the Slack timestamp and channel identifier with the authorization receipt so edits or deletions can be traced to the original reviewed request.

Resolve the channel by immutable workspace and channel IDs. Names can be reused, renamed, or confused across workspaces. Fetch privacy, shared-channel status, archived state, membership count, and posting restrictions immediately before the decision so policy sees the actual destination rather than the agent's label.

Treat interactive features as additional impact. User-group mentions, workflow triggers, application unfurls, canvases, and linked files can notify or expose more people than plain text. The adapter should surface these attributes and block unsupported message forms instead of flattening them into an apparently ordinary announcement.

Test edited content, deleted channel, removed bot membership, thread versus channel post, scheduled delivery, rate limits, and retry after timeout. Use Slack's client message identifier for idempotency where available and correlate the final timestamp without assuming that a network timeout means the message was not posted.

What good looks like

A narrow policy that can be tested in shadow mode, reviewed with owners, and promoted to enforcement with measurable impact.

• Match the concrete action "post_message" rather than every operation exposed by the tool.
• Scope the target to high-reach or external Slack channels and the production environment.
• Require a request-bound approval that expires and cannot be reused.
• Record denied attempts as well as approved executions.

A production workflow

1. Copy the template and replace example identities and resource selectors.
2. Run it in shadow mode against representative requests.
3. Review false positives, missing resource attributes, and approver routing.
4. Enable enforcement for one agent and expand only after reviewing the decision log.

A policy you can test

AI agent Slack announcement policy is a concrete starting point, not a claim that one generic rule fits every environment. Replace example identities and selectors, validate the request shape, and begin in shadow mode.

name: slack-announcement
match:
  tool: slack
  action: post_message
  resource.channel: ["announcements", "external-*"]
decision: require_approval
approval:
  reviewers: ["communications"]
  expires_in: 30m

Endram keeps the policy version with every decision. A later change creates new evidence instead of rewriting why an earlier request was permitted.

Evidence to require

• Every attempted post_message, including denied requests.
• The exact high-reach or external Slack channels selector evaluated by policy.
• The requesting agent, delegated user, reviewer, and timestamps.
• Policy version, matched rule, decision reason, and execution result.

Buyer checklist

• Does the selector cover only the intended production resources?
• Who owns the approval queue outside business hours?
• What is the acceptable approval expiry?
• Which emergency identity may bypass the rule, and how is that use audited?