Skip to main content
Control who can configure, who can see, and what stays private. Slack Agent uses both Slack-native admin status and CodeRabbit-specific roles. Everyone in the workspace can sign in, but only the right people can change configuration, view activity, or manage scopes.

Global admins and scope admins

Global admins

Global admins are the people who can manage the workspace as a whole. They include:
  • Native Slack admins
  • Slack workspace owners and primary owners
  • Users with the CodeRabbit cr_admin override

Scope admins

Scope admins can manage only the scopes assigned to them. They can tune repositories, connections, spend settings, and channel targeting for those scopes, but they cannot manage the full workspace.
Scope admins cannot edit the Base Scope. The Base Scope remains reserved for global admins.

What each role can do

ActionGlobal adminScope adminMember
Sign in and access the UIYesYesYes
Create or delete scopesYesNoNo
Edit the Base ScopeYesNoNo
Edit assigned scopesYesYesNo
Manage workspace settings and connectionsYesNoNo
Reset the workspace GitHub connectionYesNoNo

Workspace activity visibility

Usage visibility is role-aware.
ViewerWhat they can see
Global adminAll workspace activity
Scope adminActivity for the scopes they manage, plus their own activity elsewhere
MemberTheir own activity

Knowledge Base privacy

Knowledge follows Slack privacy boundaries.
Slack surfaceKnowledge behavior
Public channels and other shared surfacesUse the global workspace Knowledge Base
Private channelsUse a private conversation Knowledge Base
DMs and group DMsUse a private conversation Knowledge Base
Private knowledge can reference shared knowledge, but it should not be silently treated as shared workspace memory.

Shared sandbox access

Slack Agent currently uses a shared workspace sandbox model rather than a private sandbox for every individual user. That makes workspace governance important:
  • Configuration changes affect the workspace environment
  • Saved state can be reused across runs
  • Admins should be deliberate about who can manage sandbox settings

Good rollout practices

  • Keep the Base Scope conservative at first
  • Delegate scopes only where needed
  • Review usage visibility before wider rollout
  • Treat private channels and DM knowledge as materially different from shared workspace memory

What’s next

Slack permissions

Review the Slack app and OAuth permissions Slack Agent requests and why they are needed.

Usage

See what activity global admins, scope admins, and other members can inspect after rollout.

Sandboxes

Understand the shared sandbox model and how workspace-level execution state is managed.