Slack

Setup

1. Create a Slack app

api.slack.com/apps → Create New App → From scratch.

Under OAuth & Permissions, add scopes:

• chat:write — send messages
• channels:read — list channels
• channels:history — read channel history
• search:read — search messages
• users:read — resolve user IDs to names

Redirect URL: https://tappass.example.com/api/connect/slack/callback

2. Configure on TapPass server

SLACK_CLIENT_ID=<id>
SLACK_CLIENT_SECRET=<secret>

3. Install into your workspace

Open GET /api/connect/slack (or use the dashboard) to start Slack’s OAuth install flow. TapPass stores the workspace credential in the vault.

Operations

Operation	Op group	Endpoint
send_message	write	POST /chat.postMessage
list_channels	read	GET /conversations.list
channel_history	read	GET /conversations.history
search_messages	read	GET /search.messages

Usage

Your agent never calls Slack directly. When the model requests a Slack operation as a tool call through the governed gateway, TapPass resolves the provider, fetches the connected credential from the vault, executes the operation, and audits the call. send_message is gated by your tool-decision policy before anything is posted.

Example policy

Prevent an agent from posting to any #exec-* channel:

For example, you can block send_message to any channel whose name starts with #exec-. Rules like this are authored in the dashboard, from a template, or in plain English.

PII redaction

Outbound payloads are scanned for PII (email, phone, financial) before leaving TapPass; policy decides whether detections are masked or blocked.