Allow configured tools in shared Slack channels (#1238)

Author: penso

crates/config/src/template.rs

@@ -900,6 +900,8 @@ port = {port}                           # Port number (auto-generated for this i
 # dm_policy = "allowlist"
 # allowlist = []
 # operators = []             # Exact sender IDs allowed to run privileged commands; empty means nobody.
+# untrusted_audience = "public" # "trusted" makes MCP and other trusted-audience tools eligible.
+# untrusted_tools = "deny_all"  # "policy" lets configured policy layers decide.
 # thread_replies = true
 # stream_mode = "edit_in_place" # use "native" for Slack live text and tool task cards
 # ack_reactions = true       # 👀 on receipt, phase emoji while working, ✅/❌ on completion

crates/slack/src/config.rs

@@ -2,7 +2,7 @@ use std::collections::HashMap;
 
 use {
     moltis_channels::{
-        config_view::ChannelConfigView,
+        config_view::{ChannelConfigView, UntrustedAudience, UntrustedTools},
         gating::{DmPolicy, GroupPolicy, MentionMode},
     },
     moltis_common::secret_serde,
@@ -104,6 +104,16 @@ pub struct SlackAccountConfig {
     #[serde(default)]
     pub channel_allowlist: Vec<String>,
 
+    /// Tool audience ceiling for turns outside an operator direct chat
+    /// (default: `public`).
+    #[serde(default)]
+    pub untrusted_audience: UntrustedAudience,
+
+    /// Name policy for turns outside an operator direct chat
+    /// (default: `deny_all`).
+    #[serde(default)]
+    pub untrusted_tools: UntrustedTools,
+
     /// Default model for this account.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub model: Option<String>,
@@ -178,6 +188,8 @@ impl std::fmt::Debug for SlackAccountConfig {
             .field("allowlist", &self.allowlist)
             .field("operators", &self.operators)
             .field("channel_allowlist", &self.channel_allowlist)
+            .field("untrusted_audience", &self.untrusted_audience)
+            .field("untrusted_tools", &self.untrusted_tools)
             .field("model", &self.model)
             .field("model_provider", &self.model_provider)
             .field("agent_id", &self.agent_id)
@@ -210,6 +222,8 @@ impl Default for SlackAccountConfig {
             allowlist: Vec::new(),
             operators: Vec::new(),
             channel_allowlist: Vec::new(),
+            untrusted_audience: UntrustedAudience::default(),
+            untrusted_tools: UntrustedTools::default(),
             model: None,
             model_provider: None,
             agent_id: None,
@@ -241,6 +255,14 @@ impl ChannelConfigView for SlackAccountConfig {
         &self.channel_allowlist
     }
 
+    fn untrusted_audience(&self) -> UntrustedAudience {
+        self.untrusted_audience
+    }
+
+    fn untrusted_tools(&self) -> UntrustedTools {
+        self.untrusted_tools
+    }
+
     fn dm_policy(&self) -> DmPolicy {
         self.dm_policy.clone()
     }
@@ -292,7 +314,7 @@ pub struct RedactedConfig<'a>(pub &'a SlackAccountConfig);
 impl Serialize for RedactedConfig<'_> {
     fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
         let c = self.0;
-        let mut count = 17; // always-present fields
+        let mut count = 20; // always-present fields
         count += c.signing_secret.is_some() as usize;
         count += !c.reaction_trigger_emojis.is_empty() as usize;
         count += c.model.is_some() as usize;
@@ -314,6 +336,8 @@ impl Serialize for RedactedConfig<'_> {
         s.serialize_field("allowlist", &c.allowlist)?;
         s.serialize_field("operators", &c.operators)?;
         s.serialize_field("channel_allowlist", &c.channel_allowlist)?;
+        s.serialize_field("untrusted_audience", &c.untrusted_audience)?;
+        s.serialize_field("untrusted_tools", &c.untrusted_tools)?;
         if c.model.is_some() {
             s.serialize_field("model", &c.model)?;
         }
@@ -365,6 +389,8 @@ mod tests {
         assert!(cfg.group_allowlist().is_empty());
         assert_eq!(cfg.dm_policy(), DmPolicy::Allowlist);
         assert_eq!(cfg.group_policy(), GroupPolicy::Open);
+        assert_eq!(cfg.untrusted_audience(), UntrustedAudience::Public);
+        assert_eq!(cfg.untrusted_tools(), UntrustedTools::DenyAll);
         assert!(cfg.model().is_none());
         assert!(cfg.model_provider().is_none());
     }
@@ -479,6 +505,41 @@ mod tests {
         assert_eq!(redacted["ack_reactions"], serde_json::json!(false));
     }
 
+    #[test]
+    fn untrusted_tool_ceiling_round_trips_and_redacts() {
+        let cfg: SlackAccountConfig = serde_json::from_value(serde_json::json!({
+            "bot_token": "xoxb-test",
+            "app_token": "xapp-test",
+            "untrusted_audience": "trusted",
+            "untrusted_tools": "policy",
+        }))
+        .unwrap();
+
+        assert_eq!(cfg.untrusted_audience(), UntrustedAudience::Trusted);
+        assert_eq!(cfg.untrusted_tools(), UntrustedTools::Policy);
+
+        let stored = serde_json::to_value(&cfg).unwrap();
+        let round_tripped: SlackAccountConfig = serde_json::from_value(stored).unwrap();
+        assert_eq!(
+            round_tripped.untrusted_audience(),
+            UntrustedAudience::Trusted
+        );
+        assert_eq!(round_tripped.untrusted_tools(), UntrustedTools::Policy);
+
+        let redacted = serde_json::to_value(RedactedConfig(&round_tripped)).unwrap();
+        assert_eq!(redacted["untrusted_audience"], "trusted");
+        assert_eq!(redacted["untrusted_tools"], "policy");
+    }
+
+    #[test]
+    fn invalid_untrusted_tool_ceiling_is_rejected() {
+        let invalid_audience = serde_json::json!({ "untrusted_audience": "everyone" });
+        assert!(serde_json::from_value::<SlackAccountConfig>(invalid_audience).is_err());
+
+        let invalid_tools = serde_json::json!({ "untrusted_tools": "allow_all" });
+        assert!(serde_json::from_value::<SlackAccountConfig>(invalid_tools).is_err());
+    }
+
     #[test]
     fn connection_mode_events_api_round_trip() {
         let json = serde_json::json!({

docs/src/channels.md

@@ -273,10 +273,11 @@ current chat (`/attach`, `/sessions`, `/context`, `/insights`, `/peek`, `/btw`).
 New commands default to operator direct-chat only, so adding one is safe until
 it is deliberately reviewed.
 
-Guest, shared-room, and unknown-topology channel turns receive no tools. The
-gateway applies both the registry's public audience ceiling and a deny-all name
-policy, so account, group, and per-sender tool policies cannot restore even a
-tool reviewed for other untrusted origins.
+By default, guest, shared-room, and unknown-topology channel turns receive no
+tools. The gateway applies both the registry's public audience ceiling and a
+deny-all name policy, so account, group, and per-sender tool policies cannot
+restore even a tool reviewed for other untrusted origins unless the channel
+account explicitly lifts that ceiling as described below.
 
 Every normal turn in a shared room is untrusted, including turns sent by an
 operator, because the shared history contains messages from other people.
@@ -382,9 +383,9 @@ Untrusted tool restrictions stack with the per-channel tool policy
 policies can further restrict an operator DM, but cannot enable tools for a
 guest, shared room, or unknown chat: the untrusted ceiling denies everything
 before they are consulted. An account that raises its ceiling with
-`untrusted_audience` and `untrusted_tools` (WhatsApp only for now) hands the
-decision back to those policies for its own untrusted turns. The `/sh`
-shortcut stays restricted to operator direct chats either way.
+`untrusted_audience` and `untrusted_tools` hands the decision back to those
+policies for its own untrusted turns. Slack and WhatsApp support these settings.
+The `/sh` shortcut stays restricted to operator direct chats either way.
 
 Grant eligibility for privileged access by adding the sender to `operators`;
 the sender must still use a proven direct chat.

docs/src/slack.md

@@ -108,7 +108,10 @@ offered = ["slack"]
 | `group_policy` | no | `"open"` | Who can talk to the bot in channels: `"open"`, `"allowlist"`, or `"disabled"` |
 | `mention_mode` | no | `"mention"` | When the bot responds in channels: `"always"`, `"mention"`, or `"none"` |
 | `allowlist` | no | `[]` | Slack user IDs allowed to DM the bot (when `dm_policy = "allowlist"`) |
+| `operators` | no | `[]` | Exact Slack user IDs eligible for privileged commands in proven direct chats. Empty means nobody. |
 | `channel_allowlist` | no | `[]` | Slack channel IDs allowed to interact with the bot |
+| `untrusted_audience` | no | `"public"` | Tool audience ceiling for turns outside an operator direct chat: `"public"` or `"trusted"` |
+| `untrusted_tools` | no | `"deny_all"` | Tool name policy for those turns: `"deny_all"`, or `"policy"` to let configured policy layers decide |
 | `otp_self_approval` | no | `true` | Enable OTP self-approval for non-allowlisted DM users |
 | `otp_cooldown_secs` | no | `300` | Cooldown after failed OTP attempts |
 | `model` | no | — | Override the default model for this channel |
@@ -143,6 +146,7 @@ dm_policy = "allowlist"
 group_policy = "open"
 mention_mode = "mention"
 allowlist = ["U0123456789", "U9876543210"]
+operators = ["U0123456789"]
 channel_allowlist = ["C0123456789"]
 otp_self_approval = true
 otp_cooldown_secs = 300
@@ -163,6 +167,40 @@ model = "claude-sonnet-4-20250514"
 model_provider = "anthropic"
 ```
 
+### Tools in Shared Channels
+
+By default, Slack channels and DMs from non-operators receive no tools. To let
+those turns use tools, lift both parts of the untrusted-turn ceiling and use a
+tool policy to restrict what is available:
+
+```toml
+[channels.slack.my-bot]
+untrusted_audience = "trusted"
+untrusted_tools = "policy"
+
+[channels.slack.my-bot.tools.groups.channel]
+allow = ["linear_*"]
+
+[channels.slack.my-bot.tools.groups.direct]
+allow = ["linear_*"]
+```
+
+`untrusted_audience = "trusted"` makes MCP, WASM, and other trusted-audience
+tools eligible. `untrusted_tools = "policy"` removes the blanket name denial.
+Both settings are required for MCP tools, and without a restrictive policy the
+turn can reach every tool allowed by the remaining policy layers.
+
+The ceiling applies to every turn outside an operator direct chat, so restrict
+both `channel` and `direct` when non-operator DMs are enabled. For accounts
+created in the web UI, Advanced Config can set the two ceiling fields, but
+database-backed `tools.groups` policies are not currently part of runtime
+policy resolution. Configure a restrictive global or provider policy before
+lifting the ceiling on a UI-managed account.
+
+These settings do not expose `/sh`, privileged commands, or owner-private
+prompt context in shared rooms. Those remain restricted to operators in proven
+direct chats.
+
 ### Events API Mode
 
 Set these Request URLs in your Slack app (replace `<id>` with the account ID you

docs/src/tool-policy.md

@@ -3,8 +3,11 @@
 Tool policies control which tools are available during a session. Before these
 name-based layers run, Moltis applies the registry's host-owned audience
 ceiling. Guest, shared-room, and unknown-topology channel turns receive no
-tools. Webhooks receive no tools by default and can explicitly opt into tools
-registered for public use. Policies may narrow but never widen these ceilings.
+tools by default. Supported channel accounts can explicitly lift that ceiling
+and hand tool selection back to these policy layers. Webhooks receive no tools
+by default and can explicitly opt into tools registered for public use. Policy
+layers may narrow or widen access only within the host-owned ceiling selected
+for the request.
 
 Within the audience ceiling, policies use a layered system where each layer can
 restrict or widen access, and **deny always wins** — once a tool is denied at
@@ -111,9 +114,11 @@ allowed, and `exec`/`write_file` are explicitly denied. See
 ## Layer 4 — Per-Channel Chat Type
 
 Channel accounts can restrict tools by chat type (`private`, `group`,
-`channel`, etc.). Guest, shared-room, and unknown-topology turns already have a
-non-widenable deny-all policy. This layer is primarily useful for narrowing the
-tools available to an operator in a proven direct chat.
+`channel`, etc.). By default, guest, shared-room, and unknown-topology turns
+have a deny-all ceiling, so this layer primarily narrows tools available to an
+operator in a proven direct chat. Channels that support `untrusted_audience`
+and `untrusted_tools` can explicitly lift that ceiling and hand the decision
+back to this layer.
 
 ```toml
 [channels.telegram.my-bot.tools.groups.private]
@@ -126,8 +131,9 @@ handled by the `my-bot` account. Web UI sessions are unaffected.
 ## Layer 5 — Per-Sender
 
 Within a channel chat type, individual senders can receive name-policy
-overrides. Overrides cannot cross the deny-all ceiling applied to guests,
-shared rooms, and unknown chat kinds.
+overrides. Overrides cannot cross the default deny-all ceiling applied to
+guests, shared rooms, and unknown chat kinds unless the account explicitly
+lifts that ceiling.
 
 ```toml
 [channels.telegram.my-bot.tools.groups.private]
@@ -139,8 +145,10 @@ allow = ["*"]
 
 Sender `123456` gets `allow = ["*"]`, which replaces the previous allow list.
 However, because **deny always accumulates**, the `exec` and `browser` denials
-from the chat-type layer still apply. The sender must also be a configured
-operator in a proven direct chat; a sender override alone never grants tools.
+from the chat-type layer still apply. By default, the sender must also be a
+configured operator in a proven direct chat; a sender override alone never
+grants tools. A supported channel account can instead opt its untrusted turns
+into policy-based access with `untrusted_audience` and `untrusted_tools`.
 
 ## Layer 6 — Sandbox