This page describes AAES Govern’s controls. AAES Operate has private-work permissions, operational reviews and recorded-spend limits; it does not include Govern. About AAES Govern
Before you enable this package
Use the bot-token reference for bot actions and a separate user token with files:write for files.sharedPublicURL. The references are not interchangeable. Supply complete Authorization header values and restrict access to the required channels.
Read each action's effects and exclusions below. Before installation, also read the complete package requirements, including credential issuance, scope, expiry, and provider permissions. These are deployment prerequisites, not capabilities this package supplies.
Capabilities (5)
Each capability below is one registered operation. The complete package JSON includes its exact network destination allowlist. The repository stores it at packs/slack.json and embeds a copy in the release binary.
Versions. This package is version 1.1.0. Its capabilities carry their own version numbers: 3 at version 1.0.0, 2 at version 1.1.0, as shown on each capability below.
Risk tiers. R0 is the minimum for reads. R2 is the minimum for write, create, update, execute, and invoke. R3 is the minimum for delete, send, pay, deploy, approve, share, and transfer. Operators can raise these levels. A minimum tier does not measure the operation's business or confidentiality risk.
On supported execution paths routed through AAES Govern, the R3 actions listed below require approval by an authorized person. Bypass paths and observation-only registrations are outside that guarantee. A provider's restoration feature does not remove this approval requirement. A provider-side approval, such as approving a GitLab merge request, is also separate from AAES Govern human approval. The capability matrix shows which execution paths are implemented, restricted to lab use, or refused at startup. Live compatibility must be tested in your environment.
Field guide. Endpoint is the service address and request method. Connector is the adapter that makes the call. Custody describes how the credential is held; the credential reference identifies the value to resolve. Data class sets handling requirements: pii means personal data, financial means financial records, and internal means internal organizational data.
slack.conversations.list v1.0.0R0
- Kind
- tool
- Action
- read
- Endpoint
GET https://slack.com/api/conversations.list- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-slack-bot-token- Data class
- internal
List conversations.
List the channels in the workspace the bot can see.
slack.conversations.history v1.0.0R0
- Kind
- tool
- Action
- read
- Endpoint
GET https://slack.com/api/conversations.history- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-slack-bot-token- Data class
- pii
Read conversation history.
Read message history from one channel; messages routinely contain personal data, so the read is classified as pii (personal data).
slack.chat.postMessage v1.1.0R3
- Kind
- tool
- Action
- send
- Endpoint
POST https://slack.com/api/chat.postMessage- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-slack-bot-token- Data class
- pii
Post messages.
Post a message to a channel. A message cannot be recalled after delivery, and send is one of the designated actions requiring human approval, which is why it carries the minimum R3 tier. The message lands in a channel whose history this pack classifies pii, and Slack's formatting documentation lets message text mention users by id (<@U…>), which Slack renders as the user's display name, so the capability is classified pii (personal data), the same class as the slack-workspace resource.
slack.files.share v1.1.0R3
- Kind
- tool
- Action
- share
- Endpoint
POST https://slack.com/api/files.sharedPublicURL- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-slack-user-token- Data class
- pii
Share files.
Create a public sharing link for a file uploaded to the workspace. Revoking a link cannot undo disclosure to people who already accessed it. Registered as share at R3. Slack documents that the returned file object names the uploading user (the user field), and the shared file's content is caller-chosen, so the capability is classified pii (personal data), the same class as the slack-workspace resource.
Slack documents files.sharedPublicURL for user tokens with files:write, with no bot-token entry. This capability therefore uses secret-ref-slack-user-token, separate from the package's bot-token reference. Store a user token with files:write under that reference; the references are not interchangeable. See the credential note for the header contract.
slack.reactions.add v1.0.0R2
- Kind
- tool
- Action
- create
- Endpoint
POST https://slack.com/api/reactions.add- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-slack-bot-token- Data class
- internal
Add reactions.
Add an emoji reaction to a message.
Credential reference
The credential field names a reference rather than containing credential material. Packs are designed not to contain secrets; the format checks cover only known credential formats and cannot prove that arbitrary text contains no secrets. Installing a package registers its capabilities. Configure the provider credentials, endpoints, and network access, then test the integration in your environment before enabling it.
- Reference
secret-ref-slack-bot-token- Custody
- customer_vault
- Injection
- header (Authorization)
Configure the value and injection format specified in the package. Assign responsibility for credential rotation and revocation, restrict provider permissions, and keep credential material out of logs and responses.
Complete credential requirements
Slack API tokens held in the client's own secret manager. The stored material under any of this pack's references must be the complete Authorization header value (scheme included), never just the token. The package contains references, not token values. The executor resolves those references when making a call. This pack-level reference, secret-ref-slack-bot-token, binds the four bot capabilities (slack.conversations.list, slack.conversations.history, slack.chat.postMessage, slack.reactions.add): the stored value is a Slack bot token, and the bot scopes are a starting point — review them against the channels this workspace actually needs before enabling. slack.files.share is deliberately bound differently: it carries its own per-capability credential reference, secret-ref-slack-user-token, because Slack documents files.sharedPublicURL for user tokens only (User token: files:write, with no bot-token row).
The stored value under the user-token reference must be a Slack user token bearing files:write, minted and stored by an external deployment process; the two references are not interchangeable, and enabling slack.files.share requires the user-token reference to be populated separately from the pack-level bot-token reference.
Resources
slack-workspace(channel, pii):slack://workspace/REPLACE-WITH-WORKSPACE-ID
Technical package and review record
Complete provider requirements and exclusions
This pack registers five Slack Web API methods on slack.com/api, each checked against Slack's method reference: conversations.list (GET; channels:read covers the default public_channel type, and private channels, DMs and group DMs are listed only when the token also has groups:read, im:read or mpim:read), conversations.history (GET; the *:history scope for the conversation type), chat.postMessage (POST; chat:write, plus chat:write.public to post in public channels the bot has not joined), reactions.add (POST; reactions:write) and files.sharedPublicURL (POST; a user token with files:write). Grant only the scopes for the conversation types and capabilities you enable.
Approval classification: the two reads sit at the minimum R0 tier; adding a reaction is create at the minimum R2 tier; posting a message is send at the minimum R3 tier, because Slack's chat.delete can remove a message but cannot undo the fact that people have read it; creating a public file link is share at the minimum R3 tier. Slack documents that only the file's creator can make a file public unless it has been shared into a public channel, and a workspace can disable public file sharing.
Data classes: message history, message posting and public file links are classified pii (personal data), matching the workspace resource: posted text can mention users by id and lands in channels whose history is personal data, and a shared file object names its uploader. The channel list and reaction capabilities are registered internal. Pack version 1.1.0 moved the message-post and file-link capabilities from internal to pii; a capability's version is the pack version in which its registration last changed.
Exclusions: this pack does not register message update or deletion (chat.update, chat.delete), file upload or file deletion, reactions.remove, revoking a public file link, user and profile reads, channel creation, joining, archiving or membership changes, admin and SCIM APIs, the Events API and Socket Mode. The bot-token and user-token references are not interchangeable; see the credential note.
AAES has not been certified by Slack; the endpoints here are configuration to review and test; the vendor has not endorsed it.
Download the complete package JSON for exact network allowlists, credential requirements, exclusions, and setup notes. Read these requirements before installation.
The full documentation review record is supplied in the evaluation package. The evaluation package runs in your environment and comes only with the paid design partnership. This page reproduces the source links and review block; the full record is available for evaluation. Discuss a design partnership to inspect it before installation.
Review block
This section reproduces the review block recorded in the pack file. The evidence and approval record is separate: for a reviewed pack, it is in the evaluation materials and in the release binary's embedded assets.
Review completed: 2026-10-22
6 sources, retrieved 2026-09-20, 2026-09-23
- https://docs.slack.dev/reference/methods/chat.postMessage (retrieved 2026-09-20)
- https://docs.slack.dev/reference/methods/conversations.history (retrieved 2026-09-20)
- https://docs.slack.dev/reference/methods/files.sharedPublicURL (retrieved 2026-09-20)
- https://docs.slack.dev/changelog (retrieved 2026-09-20)
- https://docs.slack.dev/reference/methods/conversations.list (retrieved 2026-09-23)
- https://docs.slack.dev/reference/methods/reactions.add (retrieved 2026-09-23)
Current documentation links are navigation aids. They do not change the package, its historical sources or its review date. Review dates describe a documentation review, not a live integration test. No package is provider-endorsed or yet tested against a live provider tenant.
Release identity
SHA-256 of the pack file bytes: 50ca25859608d75ab3e1e67f63de550802387d9371dc0bb18323835f70d52b55
Distributable: yes, digest matches the release manifest. Editing a package changes its release identity. A deployment plan checks its own file digests; it does not restore reviewed status or authenticate approval.