App and AI Administration and Automations20% of the exam
Evaluating app scopes and tokens against policy
How to read an app's requested scopes and token types against a security policy: bot versus user tokens, the scopes that reach private conversations, email addresses or another identity, why scopes cannot be removed from a token, and how AI agent apps and org-level API apps get their access.
Given a scenario, evaluate the app scopes for compliance to security policies.
~8 min read · 18 practice questions ·
What the exam expects
- Judge an app's permissions by what information it can access and what it can do with it, and know where to find installed apps' access and a Marketplace app's security details.
- Choose bot or user tokens for a policy, knowing what a user token inherits and what happens when the installer is deactivated.
- Flag the specific scopes that break a policy: private channel and DM history, posting where the app was not added, posting under a custom identity, reading email addresses.
- Explain why a removed scope stays on a token, and what an approval call grants when it does not list scopes.
- Predict what AI agent apps and org-level Discovery API apps can reach.
Key terms:
- Scope: a permission an app requests; an app has no access by default and can do only what its scopes allow.
- Bot token (
xoxb-): tied to the app, not to a person. - User token (
xoxp-): acts on behalf of the member who authorized it, with that member's access. - Legacy
botscope: the old umbrella bot permission that bundled many permissions. - Agent: an app that takes multi-step actions in Slack on a member's behalf.
Key facts
Legacy
bot scope- Detail
- Older app with wide access
Token prefixes
- Detail
- Bot
xoxb-, userxoxp-, app-levelxapp-
Installer deactivated
- Detail
- User token revoked; bot app stays installed
channels:history as user scope- Detail
- Any public channel
chat:write.public- Detail
- Posts to channels the app isn't in
Email field
- Detail
- Needs
users:read.email
Removing a scope
- Detail
- Revoke the token and reinstall
admin.apps.approve without scope lists- Detail
- Grants every requested scope
Developer security details
- Detail
- Security & Compliance tab on the Marketplace page
Agent permissions
- Detail
- Follow app scopes, not native AI settings
Discovery, admin, SCIM API apps
- Detail
- Org data once installed at org level
Sources for this section (8)
- Understand app permissionsslack.com (opens in a new tab)
- Tokensdocs.slack.dev (opens in a new tab)
- Installing with OAuthdocs.slack.dev (opens in a new tab)
- chat:write.publicdocs.slack.dev (opens in a new tab)
- users:read.emaildocs.slack.dev (opens in a new tab)
- Managing app approvalsdocs.slack.dev (opens in a new tab)
- Security recommendationsslack.com (opens in a new tab)
- Manage apps in an Enterprise organizationslack.com (opens in a new tab)
- Why does a request for the `bot` scope deserve extra scrutiny?
- When does an app's `groups:history` bot scope let it read a private channel?
- Which scope lets an app post with a custom username and avatar?
- Where does a Workspace Owner see who installed an app and what it can access?
- Why can an org-level Discovery API app collect from workspaces it was never added to?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 32 lessons of the Slack Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (18 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams