What can an AI agent do with
See everyone's email address?
Lets the agent see the email address of every person in the workspace and find people by email. It must be requested together with users:read.
How to spot it
On a Slack connection or settings screen, this is users:read.email.
With it, an agent can
- See email addresses on profiles
- Look someone up by their email address
It cannot, on its own
- Send email
- Work on its own (it comes with users:read)
What a bad day looks like
The agent exports every coworker's email address, giving spammers or phishers a ready-made target list.
Set it up safer
- Grant users:read alone if it only needs names
Narrower permissions on Slack:
- See people in the workspace
users:read
Ask the company selling the agent
- Why does the agent need our email addresses?
- Are the addresses stored or shared with anyone?
Source
Checked against Slack documentation on 2026-09-28. All Slack permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.