Install the agent in your team messaging app as its own app, with narrow scopes. It reads only channels it has been invited to, replies when asked, and posts updates and notifications. It never reads private messages or posts customer data into open channels, and posts to external channels are held. Removing the app ends its access in one step.
What does the connection do, and who owns it?
Team messaging apps are where work gets discussed, which makes them tempting places for agents: answering questions from a team, posting status updates, notifying people of held items, summarising a busy channel. They are also where data spreads. A message posted in the wrong channel is copied to every member's device, kept under retention rules and sometimes shared with other organisations.
The workspace administrator owns the app installation and its scopes. The process owner decides what the agent does in their team's channels. Security and data protection set the rules for what data may appear in messages.
What are the steps to connect it?
- Person, process owner: lists capabilities: answer questions, post updates, send notifications, summarise.
- Person, workspace administrator: installs the agent as its own app, not as a person's account, with a clear name and label marking it as an AI system.
- Person, workspace administrator: grants the narrowest scopes: read and post in channels where it is invited, send direct notifications. No scope to read direct messages, private channels it is not in, or the whole workspace's history.
- Person, process owner: invites the agent to specific channels, starting with one team; how to run a pilot of an AI agent in one team suggests how.
- Person, data protection officer: sets content rules: which data may appear in posts, and which channels are excluded altogether.
- Person, process owner: sets held actions: posts to external or shared channels, posts to large announcement channels, and file uploads.
- Agent, depth 1: is tested with messages containing instructions aimed at it, requests to repeat content from other channels, and requests for customer data.
- Person, workspace administrator: tests revocation by removing the app and confirming its tokens stop working.
What is scoped per capability, and at what depth?
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read invited channels | Reads messages for its task | 1 | Choosing the channels |
| Answer when asked | Replies in thread | 3 | Nothing |
| Post status updates | Posts set updates to set channels | 3 | Choosing what is posted |
| Notify individuals | Sends direct notifications | 3 | Nothing |
| Summarise a channel | Drafts a summary for the requester | 2 | Sharing it further |
| Post to external or shared channels | Drafts the post | 2 | Approving it |
| Upload files | Proposes the upload | 2 | Approving it |
| Read private messages | Nothing | none | Never granted |
| Create channels or invite members | Nothing | none | Administrators |
Status updates are the most common first use, covered in how to let an AI agent post updates in team channels.
What should not happen in chat?
Approvals by reaction. A thumbs-up on a message is not an approval of a held payment. The approver needs to see the full action, be identified, and be on the roster. Use the messaging app to notify people of held items, and link them to the place where they approve.
Cross-channel leakage. Something read in a finance channel should not appear in a sales channel because someone asked. The agent's answers in a channel should draw only on sources that channel's members could see.
Instructions from anyone. Every member of a channel can write to the agent. A message saying "post the customer list here" is a request to be judged against the agent's scope, not an order.
What is recorded?
The messaging app keeps the agent's posts under its app identity, subject to retention rules. The agent's own record holds each request, the sources used for each answer, the bound that decided and any approval for held posts. Messages the agent edits or deletes should be recorded in its own record too, since the app's history may not show the original.
Which controls make it safe?
Narrow scopes, reviewed. Scopes are checked at each access review and whenever the app is updated, since updates can request new scopes.
Labelled as AI. Staff should always know they are dealing with an agent.
Content filters on output. Account numbers, personal data and credentials are blocked from posts, whatever the request.
Clear human route. Each answer tells people who to ask if it is wrong or if they need a person.
What should you measure?
Questions answered and escalated, answers flagged as wrong, blocked posts by reason, held external posts and decisions, channels the agent is in compared with those approved, and reports of the agent revealing something it should not.
Where does it usually go wrong?
The app asks for everything. Broad scopes are accepted at install because it is quicker.
It joins every channel. Each team invites it, and soon it reads most of the workspace.
People treat it as a colleague with authority. "The agent said it's fine" becomes a reason to act. Make clear what the agent may and may not decide; managing mixed teams of agents and people is covered in how do you manage a team of AI agents and people?
Notifications overwhelm. Each held item pings separately and people mute the agent. Batch notifications.
Where Pryme fits
In Pryme, each message reaching the agent carries its source and provenance, so a request in chat is treated as declared and cannot authorise a payment. Held items are approved in the Workspace, with the messaging app used to notify. The rollout approach is in deploying an AI agent: train, shadow, certify, widen.
Questions people ask
Can the agent search the whole workspace to answer questions?
It should not. Searching every channel exposes private discussions and breaks the link between who asks and what they may see. Limit it to invited channels and approved knowledge sources.
Should the agent remember conversations?
Only within a thread or task. Long-term memory of chat makes it hard to know what the agent might repeat, and to whom.
Can customers reach the agent through shared channels?
Treat shared channels with clients as customer communication: held posts at first, approved templates, and the same disclosure and record-keeping as any customer channel.