Slack just made your coding agents more powerful. That is also the problem.
Four major AI coding agents now live natively inside your Slack workspace: Claude Code from Anthropic, Codex from OpenAI, Cursor, and GitHub Copilot. @mention any of them in a channel, and they get to work. They read your conversation history, your canvases, your connected developer tools. Then they push commits, investigate bugs, open pull requests, and trigger deployments.
Slack calls this “multiplayer coding.” Agents with full context working alongside your team, in the same channels where you argued about architecture, wrote the postmortem, and decided to delay the release.
The productivity case is real. The authorization question has not been answered.
What “full context” actually means
Context is the whole selling point. These agents work better because they can see everything your team has discussed, not just the prompt you typed.
That same context is what makes the risk concrete.
An agent with access to your Slack workspace, your codebase, and your dev tool integrations can take actions no individual engineer would take in one sitting. It can push to production without a review gate. It can call APIs against your live environment. It can delete things, not because it is malicious, but because it acted on what it knew, and no one defined what it was not allowed to do.
OWASP catalogued this as Excessive Agency (LLM06:2025). The risk traces to three causes: too much functionality, too many permissions, too much autonomy. The fix is to limit the agent to the tools it needs, scope every permission to least privilege, and put a human in front of high-impact actions before they run.
Slack gave coding agents more of all three. Again, for good reasons. But the authorization layer did not come with the announcement.
The question teams are not asking
Most teams evaluating coding agents ask some version of: can this agent write good code?
The more useful question is: which of the 400 actions this agent can take are actually authorized?
A coding agent connected to Slack, GitHub, your CI/CD pipeline, and your cloud provider has a large action surface. Some of those actions are low-stakes. Some are irreversible. Most companies have no systematic view of which is which, per agent, per workflow, per environment.
The ITSM log says “workflow completed.” The IAM log says “user accessed system.” Neither records which agent took which action, in which order, against which policy, with whose authority. When the auditor shows up, no one has a ready answer.
What deterministic governance looks like
LangGuard maps and classifies the complete action surface of every agent before it runs in production. Not with a model judging at inference time whether an action feels risky. Deterministically, at design time, against a defined policy.
For a coding agent in Slack, that means three things in practice.
You know what the agent can do before it does it. LangGuard discovers the action surface at design time and classifies every tool call the agent is capable of, along with every parameter it can pass. There are no surprises when the agent decides a production deployment is within its remit.
Segregation of Duties violations get caught in real time. The scenario where a coding agent merges its own pull request, or modifies the logging that would record what it did, does not require a malicious model. It requires insufficient authorization boundaries. LangGuard enforces those boundaries before the tool call executes.
High-risk actions route to a named human approver. When an agent attempts an action that crosses a policy threshold, it does not execute silently. It goes to a person with the authority to approve or reject it. The decision lands in the audit ledger. The next time someone asks “who authorized that,” there is a specific answer.
The audit committee is starting to ask
Coding agents in Slack are available in the Slack Marketplace today, connected to live codebases and production systems.
The productivity case for deploying them is clear. Slack made that case compellingly, and they are right that this is where software engineering is heading.
But AIUC-1 Control D003, the mandatory preventative control that requires safeguards preventing tool calls in AI systems from executing unauthorized actions, does not exempt agents because they are useful. Audit committees at companies deploying agentic workflows are beginning to ask for the evidence: per-agent tool authorization, parameter validation, logging of every tool call, and human approval workflows for high-risk operations.
“We @mentioned it in Slack” is not an authorization policy.
Start With the Action Surface
The shortest path from “we deployed a coding agent” to “we can defend that decision to an auditor” runs through a single question: what can this agent actually do?
LangGuard answers that question before the agent reaches production. You get a classified action surface for every agent in your business workflows, a real-time SoD detection layer, and a human-authority routing system for the actions that require it.
Slack Code is not the problem. Deploying it without knowing which actions are authorized is.