What can an AI agent do with
Post under a custom name and picture?
Lets the app post messages with a different display name and profile picture than its own. Bot token only, and it needs chat:write too.
How to spot it
On a Slack connection or settings screen, this is chat:write.customize.
With it, an agent can
- Post messages that show a custom name and picture
- Use a custom name and picture when sharing files
It cannot, on its own
- Work on its own (it also needs chat:write)
- Read messages
What a bad day looks like
A tricked agent posts with a name and photo that look like a coworker or manager, and people act on the message.
Set it up safer
- Leave this off so the app always posts under its own fixed name, using chat:write alone
Narrower permissions on Slack:
- Send messages
chat:write
Ask the company selling the agent
- Why does the agent need to change its name or picture?
- What names and pictures will it use?
- Can I turn this off?
Source
Checked against Slack documentation on 2026-09-28. All Slack permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.