Slack-native AI agent identity exposes channel-level privilege drift

At a glance

What this is: This analysis argues that giving a Slack-native AI agent its own scoped identity shifts the access problem from human permissions to channel-level agent privilege, creating confused-deputy risk and audit loss.

Why it matters: IAM, PAM, and NHI programmes need to treat agent identities as first-class governed subjects because channel-scoped credentials can outlive the requester, expand access, and weaken accountability.

👉 Read Hush Security's analysis of Slack-native AI agent identity and access scope

Context

A Slack-native AI agent with its own identity changes the authorisation question from who the human is to what the agent can do inside a channel. That matters because channel-scoped privilege can bypass the requester’s own entitlements, which breaks the assumptions behind least privilege, access review, and delegated administration.

The governance problem is not that the agent exists, but that identity is being assigned at the wrong layer. When a shared agent identity acts across many channels, the enterprise can lose a clean line from requester to action, which turns a convenient workflow into an NHI lifecycle and accountability problem.

Key questions

Q: How should security teams prevent a channel member from using an AI agent to reach resources they cannot access directly?

A: Security teams should make the agent’s effective permissions the intersection of the requester’s entitlements and the agent’s own scope. If the human cannot perform the action, the agent should not be able to do it on their behalf. That approach blocks confused-deputy escalation and keeps delegated access bounded by the original requester.

Q: Why do channel-scoped AI agent identities create NHI governance risk?

A: Channel-scoped agents create NHI governance risk because each identity can become a long-lived credential with its own lifecycle, ownership, and revocation burden. As the number of channels grows, so does the number of persistent access paths. Without explicit offboarding and review, those identities accumulate like unmanaged service accounts.

Q: What do security teams get wrong about audit logging for AI agents?

A: Teams often assume that logging the agent identity is enough, but shared-agent logs rarely preserve the human request, business purpose, or exact action path. That leaves attribution incomplete and recertification weak. Effective audit requires linking the requester, the channel, the agent credential, and the final action in one record.

Q: When should organisations use action-level approval instead of broad channel access for AI agents?

A: Organisations should use action-level approval whenever the agent can read sensitive data, trigger external workflows, or change privileged state. Broad channel access is too coarse for those tasks because it authorises the whole persona, not the specific act. Narrow grants reduce blast radius and make review decisions clearer.

Technical breakdown

Channel-scoped agent identity vs requester-scoped authorisation

The article describes a model where the agent holds its own credentials per channel, rather than inheriting the human’s permissions at runtime. That means authorisation is attached to the agent identity, while invocation comes from any channel member. In practice, this creates a confused deputy pattern: the agent can access resources the human could not, because the human’s permissions are never re-evaluated before execution. The control boundary has moved from user entitlement to agent scope, which is a materially different trust model.

Practical implication: enforce effective permissions as the intersection of agent scope and requester scope, not the agent scope alone.

Long-lived NHI sprawl in collaboration workflows

A per-channel agent identity is still a non-human identity, so it inherits the same lifecycle risk as service accounts, tokens, and other long-lived credentials. If every channel gets its own scoped identity, credential count rises quickly and revocation gets harder as the number of operating contexts grows. The operational issue is not simply volume. It is persistence. Long-lived agent identities can remain valid long after the business need changes, which makes offboarding, rotation, and entitlement review central rather than optional.

Practical implication: treat each channel agent as a governed NHI with explicit ownership, expiry, and offboarding criteria.

Why action-level least-agency matters more than channel-level grants

Channel-level grants allow an agent to act broadly once the credential is present, but the article notes that nothing constrains which action the agent takes with that credential. That is an authorisation failure, not just a visibility issue. Least agency means the agent should be allowed to perform only the specific action required, at the moment it is required, with clear linkage to the initiating user and task. Without that, a single credential becomes a reusable execution path rather than a narrowly scoped delegation.

Practical implication: move sensitive operations to action-level approval and task-scoped grants, not blanket channel privileges.

Threat narrative

Attacker objective: The attacker objective is to use a legitimate collaboration workflow to obtain actions, data access, or execution paths that exceed the human requester’s own permissions.

1. Entry occurs when any channel member invokes the agent in a channel that has been granted broad agent permissions, regardless of the requester’s own access.
2. Escalation happens when the agent uses its channel-scoped identity to read or act on resources the initiating human could not reach directly.
3. Impact is a privilege escalation by design, plus lost attribution across shared service-account activity and ambient multi-channel use.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Least privilege was designed for identities whose permissions can be checked against a known user at request time. That assumption fails when a Slack-native agent can be invoked by any channel member while retaining its own broader channel scope. The result is not just over-permissioning, but a broken delegation model where the requester’s entitlements no longer bound the resulting action. Practitioners should treat this as a governance failure in delegated authorisation, not a minor policy gap.

Channel-scoped agent identities are a new form of NHI sprawl, not a novel collaboration feature. Every scoped agent creates another long-lived credential, another lifecycle record, and another revocation problem. The industry has already failed to contain service-account sprawl in traditional environments, and collaboration platforms can multiply the same issue faster because every channel becomes an identity boundary. The practical conclusion is that agent identity inventories must be managed like any other NHI estate.

Action-level least-agency is the control concept this model was missing. The article’s own problem statement shows that broad channel-level grants are too coarse for sensitive work. When a credential authorises an entire agent persona instead of a single task, the enterprise loses the ability to prove why a specific action was allowed. That weakens auditability, approval integrity, and rollback logic. Security teams should treat this as a delegation design flaw, not an isolated implementation detail.

Auditability collapses when the system records that an agent acted but cannot tie the act back to a human decision. Shared service-account logging may preserve identity lifecycle metadata, but it does not preserve intent, request context, or accountability. That gap matters across IAM, PAM, and NHI governance because review processes cannot certify what they cannot explain. The practitioner takeaway is straightforward: attribution must be designed into the control path, not reconstructed after the fact.

Identity Assertion JWT Authorization Grant points to the right direction, but roadmap language is not governance. Cross-domain agent identity needs an enterprise-controlled broker model, not a proprietary access island. That aligns with OWASP-NHI and zero-trust thinking because delegation should remain centrally intelligible even when the agent moves across IdPs and tools. Security leaders should evaluate whether the access model is interoperable, reviewable, and revocable outside a single vendor boundary.

From our research:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
• For the broader identity context, 52 NHI Breaches Analysis shows how weak lifecycle control turns identity sprawl into repeated incident patterns.

What this signals

Agent identity sprawl will look operationally harmless until the first review cycle. Once collaboration platforms start issuing per-channel identities, the programme inherits another class of governed credentials that must be inventoried, scoped, and retired. The practical pressure is on IAM and NHI teams to extend lifecycle controls into messaging and collaboration systems before those identities become invisible exceptions.

Action-level delegation will become a differentiator in mature environments. Collaboration tools that can prove which user triggered which action, under which bounded scope, will fit enterprise governance better than models that only log agent activity. That is especially relevant as the market moves toward OWASP Top 10 for Agentic Applications 2026 style controls around tool misuse and identity abuse.

Channel-scoped identity should now be treated as a named governance pattern: least-agency drift. The term describes what happens when a collaboration agent is granted broad execution latitude inside a channel while the enterprise still expects human-paced approval and review. As more organisations adopt agentic workflows, this drift will force stronger alignment between NHI lifecycle controls and zero-trust authorisation models.

For practitioners

• Bind agent permissions to requester entitlements Require the agent’s effective access to equal the intersection of channel scope and the initiating user’s own permissions. This prevents a channel member from using the agent to reach data or tools they could not access directly.
• Inventory each channel agent as a governed NHI Track ownership, expiry, scope, and offboarding for every agent identity created per channel. Treat these identities as long-lived credentials with lifecycle risk, not as disposable feature flags.
• Move sensitive operations to action-level approval Reserve high-risk actions for task-scoped grants and explicit approval, rather than broad channel-level access. The control should constrain the exact operation, not just the place where the agent sits.
• Preserve human-to-action attribution Log the triggering user, the channel context, the requested action, and the resulting agent execution in one reviewable record. A shared service account alone is not enough for audit or recertification.
• Test delegation paths for confused-deputy behaviour Red-team scenarios where a low-privilege channel member attempts to drive the agent into restricted repos, tickets, or tools. If the agent can exceed the requester’s access, the policy model is wrong.

Key takeaways

• Slack-native AI agents create a delegation problem when channel access is broader than the requester’s own permissions.
• The scale issue is lifecycle, not just access: per-channel agent identities multiply persistent NHI risk and make revocation harder.
• Enterprises should move toward action-level approval, requester-bound effective permissions, and attributable audit records before these patterns become normalised.

Key terms

• Confused Deputy: A confused deputy is an identity or system that can be tricked into using its broader authority on behalf of a less-privileged requester. In agent governance, it appears when the agent can perform actions the human caller could not, making delegation wider than intent.
• Channel-Scoped Identity: A channel-scoped identity is a credential or account bound to a specific collaboration context rather than to a person. For agents, it simplifies local access but also creates a lifecycle-managed NHI with its own permissions, offboarding needs, and audit obligations.
• Least Agency: Least agency is the principle that an autonomous or semi-autonomous actor should be able to perform only the specific action needed for the current task. It is the agent-era extension of least privilege, with tighter focus on action boundaries and temporal scope.
• Attribution Gap: An attribution gap exists when the system can show that an agent acted but cannot reliably show who triggered the action, why it was allowed, or what business request it satisfied. That weakens audit, certification, and post-incident reconstruction.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or lifecycle governance, it is worth exploring.

This post draws on content published by Hush Security: Table of Contents Claude Tag and its Slack-native agent authorisation model. Read the original.