Because they turn collaboration platforms into identity-bearing execution surfaces. The agent may look like a chat feature, but it actually holds credentials, uses connected tools, and accumulates standing access. That means NHI governance has to cover ownership, entitlement scope, and offboarding inside the collaboration layer, not only in central IAM.
Why This Matters for Security Teams
Slack and similar collaboration tools become governance blind spots when an AI agent is granted tool access, message ingestion, and the ability to act on behalf of a team. The risk is not just conversation leakage. It is that the agent becomes an identity-bearing execution surface with credentials, persistent entitlements, and a path into downstream systems. Current guidance suggests treating that surface as a real workload identity, not a feature toggle.
nhi governance breaks down fastest when the collaboration layer is treated as “low risk” while the agent quietly inherits access to tickets, repos, files, and automation hooks. That is why Top 10 NHI Issues and the OWASP Agentic AI Top 10 both emphasize identity scope, tool permissions, and runtime control. In the 2024 ESG report, Oasis Security & ESG found that 72% of organisations have experienced or suspect a breach of non-human identities, which is a useful reminder that “chat assistant” is often just the visible front end of a much larger access problem. In practice, many security teams encounter agent overreach only after the agent has already touched sensitive tools, rather than through intentional design review.
How It Works in Practice
Practically, the governance problem starts with how the agent is connected. A Slack app, workflow bot, or AI assistant often uses OAuth scopes, service tokens, or delegated API access that outlives any single task. If that agent can read channels, create tickets, send files, or invoke external systems, then its identity must be managed as a workload with explicit ownership, approval boundaries, and revocation triggers. That is the same basic lesson called out in Lifecycle Processes for Managing NHIs and in the Analysis of Claude Code Security: access must be bounded to the task, not merely to the app.
For agentic deployments, the emerging pattern is a mix of workload identity, just-in-time credentials, and runtime policy checks. Instead of a long-lived bot token, the platform can issue short-lived credentials per task, tie them to a specific actor and context, and revoke them when the workflow ends. Policy engines such as OPA or Cedar can then evaluate what the agent is trying to do in real time, rather than relying only on a pre-approved role. This is where NIST Cybersecurity Framework 2.0 and the NIST AI Risk Management Framework provide useful governance language, while CSA MAESTRO agentic AI threat modeling framework helps model the tool-chaining and escalation paths that collaboration bots can create. These controls tend to break down when the workspace allows ad hoc app installation or broad channel membership because the agent’s effective access expands faster than review cycles can track.
Common Variations and Edge Cases
Tighter controls often increase operational overhead, requiring organisations to balance faster automation against stronger approval and review steps. That tradeoff becomes especially visible in shared workspaces, regulated environments, and cross-functional “always-on” assistants where users expect instant responses.
There is no universal standard for this yet. Some teams allow read-only agents in public channels but require JIT approval before any write action, while others separate informational assistants from execution agents entirely. The right choice depends on whether the agent can only summarize content or can also trigger privileged workflows. If the agent uses third-party OAuth apps, visibility becomes a second edge case: security teams may know the app exists, but not which external vendor or subservice is actually receiving data. That risk is consistent with the visibility gap highlighted in the State of Non-Human Identity Security, and it is one reason why runtime logging, secret rotation, and offboarding must extend into the collaboration platform itself. Best practice is evolving, but current guidance strongly favors short-lived entitlements, explicit owner mapping, and a kill switch for every agent that can act outside the chat layer.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Covers excessive agent permissions and tool abuse in collaboration apps. |
| CSA MAESTRO | TRM | Maps agent tool chains and escalation paths in Slack-like execution surfaces. |
| NIST AI RMF | Supports governance and accountability for autonomous AI behavior. |
Constrain agent tools, scope, and runtime actions to the minimum needed for each task.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
