I have lived in organizations where under 1% of messages were made on public channels. The experience of finding information in slack, or even knowing if there's a private channel where all of this is discussed, but where nobody invited you to, is not one I wish on anyone.
replyNo channel will disclose private information. The only way to get that to work is to DM the agent directly or to use slash commands which are ephemeral / private.
replyso your agents can't access any private information in public channels?
replyNot very useful.
Still probably better than Claude's new bot which requires a service account per channel!
Hang on a second. You think accessing private information in a public channel is a good idea?
replyIf a tool is authenticated as personal then it can be only accessed under personal context - i.e. privately. Now if the author of the agent wants to add tools authenticated with shared secrets that is something should be considered in the threat model.
In other words:
- reading my personal emails in a public setting - not ok - reading the agents shared inbox in a public setting - probably ok depending on the threat model
> not ok - reading the agents shared inbox in a public setting - probably ok depending on the threat model
replyThis is never secure. Some SAAS apps have automatic enrollment into company/teams based on email domain. So you can sign up with the email address of the agent and then ask for any 2fa code or other emails.