Channel access controls where an Agent may participate, who may interact with it, and which messages are eligible for a response.
These settings are separate from the Agent’s Template and from Agent Barn sharing. Platform access determines what the Agent can receive through Slack, Telegram, or Discord. Agent Access determines which Organization Members may view or manage the Agent inside Agent Barn.
Overview
Each Agent connects to one communication platform. The available access controls depend on that platform.
| Platform | Location boundary | Operator boundary | Direct messages | Mention behavior |
|---|---|---|---|---|
| Slack | Open channels or an allowed-channel list | Optional allowed-user list for direct messages | Off, Open, or Allowlist | Explicit mentions are required in shared channels |
| Telegram | Open group chats or an allowed-chat list | Optional allowed-user list for direct messages | Off, Open, or Allowlist | Explicit mentions are required in group chats |
| Discord | Open servers or an allowed-server list, optionally narrowed by channel | All users, or selected users and roles | Disabled | Configurable; keeping explicit mentions required is recommended |
Opening a policy does not install the Agent in new locations. The platform bot must still be added to the Slack channel, Telegram group chat, or Discord server where it will operate.
Access model
Treat channel access as three independent boundaries. A message must satisfy each configured boundary before the Agent responds.
- Location boundary Which Slack channels, Telegram group chats, or Discord servers and channels the Agent may use
- Operator boundary Which people may interact with the Agent inside those locations or by direct message
- Message boundary Whether a qualifying message is explicitly addressed to the Agent
1. Location boundary
The location boundary determines which shared locations the Agent may use:
- Slack channels
- Telegram group chats
- Discord servers and channels
An allowlist is the safest production default, because it explicitly identifies approved locations.
2. Operator boundary
The operator boundary determines who may interact with the Agent:
- Slack and Telegram can restrict direct messages to selected users.
- Discord can allow everyone inside the approved location boundary, or restrict interaction to selected users and roles.
Location and operator restrictions are cumulative. A Discord user, for example, must satisfy the configured server, channel, and user-or-role boundaries.
3. Message boundary
The message boundary determines whether a qualifying message is actually addressed to the Agent.
In shared locations, explicit mentions prevent an Agent from responding to ordinary conversation, or to messages intended for another Agent.
Before you begin
You need:
- Access to the Organization that owns the Agent
- Access to the Agent
- The
agent.updatePermission - The
agent.lifecycle.managePermission, if the Agent is Running - The platform bot already installed or added to the intended locations
- Slack channel names, Telegram numeric IDs, or Discord IDs for the boundaries you will configure
- A controlled location where you can test allowed and blocked messages
Channel configuration does not replace platform administration. The bot must still have the required platform permissions, event subscriptions, gateway intents, and membership.
Recommended production baseline
Start from the narrowest policy that still supports the Agent’s intended work.
| Platform | Recommended baseline |
|---|---|
| Slack | Channel access set to Allowlist, direct messages Off or Allowlist, and only approved channels selected |
| Telegram | Group chats set to Allowlist, direct messages Off or Allowlist, and only approved numeric IDs entered |
| Discord | Server access set to Allowlist, approved channels entered, selected users or roles used where practical, and explicit mentions required |
Open policies can be useful during initial testing, but they should be reviewed before production use.
Open channel settings
- Select the Organization that owns the Agent.
- Open the Agent from Home.
- Select Configuration.
- Open Channels & endpoint.
For Telegram Agents, this section is labelled Chats & endpoint.
The section first displays a read-only summary of the current platform policy. Select Edit to change it.
If Edit is unavailable, confirm that you have the agent.update Permission. Agent Viewers can inspect the current policy but cannot change it.
Configure Slack
Slack separates shared-channel access from direct-message access.
Choose the channel policy
Under Channel access, choose one of the following:
| Policy | Behavior |
|---|---|
| Open | The Agent may respond in any channel available to its Slack bot |
| Allowlist | The Agent may respond only in selected channels |
For production Agents, select Allowlist and add each approved channel through the channel search field.
Private Slack channels appear in the picker only after the bot has joined them.
Removing a channel from the allowlist prevents the next Runtime configuration from enabling that channel.
Configure direct messages
Under Direct messages, choose:
| Policy | Behavior |
|---|---|
| Off | The Agent ignores direct messages |
| Open | Any Slack user who can reach the bot may send it a direct message |
| Allowlist | Only selected Slack users may send it direct messages |
If you select Allowlist, search for and add each approved Slack user.
Direct messages are exempt from shared-channel mention gating, because the message is already addressed to that Agent. Use Off or Allowlist when direct access should be restricted.
Choose a Hermes home channel
For a Hermes Agent, the first selected Slack channel acts as its home channel for scheduled or proactive delivery.
A practical configuration might be:
- Channel access
- Allowlist
- First channel
#agent-alerts— home- Second channel
#agent-testing- Direct messages
- Allowlist
- Allowed users
- Selected operators
Use set home to move another selected channel into the first position.
If no channel is configured, Hermes cannot deliver scheduled or proactive Slack updates to a home destination.
Configure Hermes Slack verbosity
Hermes Slack Agents also display a Verbosity setting:
- Verbose — announces each step
- Concise — final answers only
This controls response presentation rather than access, but it is applied with the same channel configuration change and takes effect the next time the Agent starts.
Slack mention behavior
Slack shared-channel messages require an explicit mention. The requirement applies to each individual message, including messages inside an existing thread.
Use a direct message when you intentionally want a private interaction without a channel mention.
Configure Telegram
Telegram separates group-chat access from direct-message access.
Choose the group-chat policy
Under Group chats, choose:
| Policy | Behavior |
|---|---|
| Open | The Agent may respond in any group chat containing its Telegram bot |
| Allowlist | The Agent may respond only in the listed group chats |
For an allowlist, enter comma-separated Telegram chat IDs under Allowed chat IDs. Group chat IDs are numeric, and are commonly negative numbers.
-1001234567890, -1009876543210Do not enter Telegram usernames in this field.
Configure direct messages
Under Direct messages, choose:
| Policy | Behavior |
|---|---|
| Off | The Agent ignores direct messages |
| Open | Any Telegram user who can reach the bot may send it a direct message |
| Allowlist | Only users with listed Telegram user IDs may send it direct messages |
For an allowlist, enter comma-separated numeric user IDs under Allowed user IDs.
123456789, 987654321The two Telegram fields accept different identifiers.
- Group chat ID
-1001234567890— negative, used in Allowed chat IDs- User ID
123456789— positive, used in Allowed user IDs- Username
@example-name— never accepted in either field
Choose a Hermes home chat
For a Hermes Agent, the first allowed Telegram chat ID acts as the home destination for scheduled or proactive delivery. Place the intended home chat first.
-1001234567890, -1009876543210In this example, -1001234567890 is the home chat.
If no chat ID is configured, Hermes cannot deliver scheduled or proactive Telegram updates to a home destination.
Telegram mention behavior
Messages in group chats require an explicit mention of the Agent’s Telegram bot.
Direct messages do not require a mention. A direct reply to the Agent’s message in a group may also be delivered by Telegram as a message addressed to that Agent.
Configure Discord
Discord evaluates several boundaries together. A message must satisfy every enabled boundary before the Agent should act on it.
- Approved server The Discord server ID is allowed, or server access is Open
- Approved channel The channel ID is allowed, when channel restrictions are configured
- Allowed user or role The sender is allowed directly or through one of the allowed role IDs
- Explicit mention The message mentions the Agent, while mention gating stays enabled
In text: the message must arrive in an approved Discord server, inside an approved channel, from an allowed user or role, and it must mention the Agent.
Choose the server policy
Under Server access, choose:
| Policy | Behavior |
|---|---|
| Allowlist | The Agent may operate only in the configured Discord servers |
| Open | The Agent may operate in any server containing its bot |
For Allowlist, enter comma-separated Discord server IDs under Allowed server IDs.
123456789012345678, 234567890123456789Restrict Discord channels
Enter comma-separated channel IDs under Allowed channel IDs.
345678901234567890, 456789012345678901Channel restrictions continue to narrow access even when the server policy is Open. Leaving the server policy Open therefore does not make a configured channel restriction irrelevant.
Choose who may interact
Enable Allow all users when anyone inside the allowed server and channel boundaries may interact with the Agent.
Disable it when access should be restricted. Then enter at least one:
- Allowed Discord user ID
- Allowed Discord role ID
When Allow all users is disabled, Agent Barn rejects the configuration unless at least one allowed user or role is present.
- Allow all users
- Disabled
- Allowed users
567890123456789012- Allowed roles
678901234567890123
Users are eligible when their user ID is listed, or when they hold one of the allowed roles.
Set the alert destination
Use Alert destination channel ID to set the optional Discord destination for scheduled or proactive updates.
For Hermes, this serves as the home destination for those deliveries. The alert destination should also be inside the Agent’s permitted server and channel boundaries.
Require explicit mentions
Keep Require an explicit mention in server channels enabled. This prevents the Agent from treating every message in an approved channel as a request.
Apply the changes
The available action depends on the Agent’s lifecycle state.
| Agent state | Action | Result |
|---|---|---|
| Running | Apply & Restart | Stops the Agent, saves the policy, and starts it with regenerated Runtime configuration |
| Stopped or Error | Apply | Saves the policy without starting the Agent |
For a Running Agent:
- Review the new boundaries.
- Select Apply & Restart.
- Wait for the Agent to return to Working.
- Confirm that the displayed configuration matches the intended policy.
For a Stopped Agent, select Apply, then start it when you are ready to test.
For an Agent in Error, select Apply to save the correction, and then select Start from the Agent page.
Channel policy changes affect generated Runtime configuration only after the Agent starts again.
Verify the boundaries
Use a controlled test location, and test both allowed and blocked cases.
| Test | Expected result |
|---|---|
| Allowed shared location with an explicit mention | The Agent responds |
| Allowed shared location without a mention | The Agent does not respond |
| Location outside the allowlist | The Agent does not respond |
| Allowed direct-message user | The Agent responds when direct messages are enabled |
| User outside the direct-message allowlist | The Agent does not respond |
| Allowed Discord user or role in an allowed channel | The Agent responds when explicitly mentioned |
| Disallowed Discord user in an allowed channel | The Agent does not respond |
| Discord direct message | The Agent does not respond |
For Slack, also send an unmentioned follow-up inside a thread where the Agent responded earlier. The Agent should require another explicit mention.
After testing:
- Open the Agent in Agent Barn.
- Review Conversations for the allowed interaction.
- Review Logs if an expected message did not receive a response.
- Confirm that the Agent remains Working.
- Remove any temporary open policy or testing location.
A missing response is not always an access-policy failure. Also check bot membership, platform permissions, credentials, Agent health, and whether the message explicitly addressed the Agent.
Configuration field map
These are the corresponding Agent configuration fields used by the API.
| Platform | Interface setting | API field |
|---|---|---|
| Slack | Channel access | slack_group_policy |
| Slack | Allowed channels | slack_channel_ids |
| Slack | Direct messages | slack_dm_policy |
| Slack | Allowed direct-message users | slack_dm_user_ids |
| Slack and Hermes | Verbosity | slack_verbose_mode |
| Telegram | Group chats | telegram_group_policy |
| Telegram | Allowed chat IDs | telegram_allowed_chat_ids |
| Telegram | Direct messages | telegram_dm_policy |
| Telegram | Allowed user IDs | telegram_allowed_user_ids |
| Discord | Server access | discord_group_policy |
| Discord | Allowed server IDs | discord_guild_ids |
| Discord | Allowed channel IDs | discord_allowed_channel_ids |
| Discord | Allow all users | discord_allow_all_users |
| Discord | Allowed user IDs | discord_allowed_user_ids |
| Discord | Allowed role IDs | discord_allowed_role_ids |
| Discord | Alert destination | discord_home_channel_id |
| Discord | Require explicit mention | discord_require_mention |
Use open or allowlist for shared-location policies. Slack and Telegram direct-message policies accept off, open, or allowlist.
Updating these fields requires agent.update. A direct update to a Running Agent is rejected, so stop the Agent first, or use the web application’s Apply & Restart workflow.
Platform bot tokens and other credentials are managed separately under Keys & integrations, and require agent.secret.manage.
Troubleshooting
A Slack channel does not appear
Confirm that the Agent’s Slack bot has joined the channel.
For a private channel, run /invite @bot-name in that channel, then return to Agent Barn and search again.
Slack users or channels do not load
Verify that the Agent’s Slack credentials are valid, and that the Slack application has the required scopes.
Review Keys & integrations, then inspect the Agent’s health and Logs.
The Agent responds in an allowed channel but ignores follow-ups
Mention the Agent again. Slack requires a fresh mention for every shared-channel message, including thread replies.
The Telegram Agent ignores an allowed group chat
Check that:
- The configured value is the numeric group chat ID
- The group chat ID includes its leading minus sign, where applicable
- The Telegram bot is a member of the group chat
- The message explicitly mentions the bot
- The updated Agent has started successfully
Telegram direct messages are ignored
Check the direct-message policy. If it is Allowlist, confirm that the value is the sender’s numeric user ID rather than their username.
Discord rejects the configuration
If Allow all users is disabled, add at least one allowed user ID or allowed role ID.
Also confirm that every entered value is a Discord ID rather than a display name.
The Discord Agent receives events but cannot read messages
Confirm that Message Content Intent is enabled for the Discord application.
If access uses Discord roles, also confirm that the application has the membership information required to evaluate those roles.
A Discord user is unexpectedly blocked
Evaluate the complete boundary:
- Is the server allowed?
- Is the channel allowed?
- Is Allow all users enabled?
- If not, is the user ID or one of the user’s role IDs allowed?
- Did the message explicitly mention the Agent?
Failure at any enabled boundary can prevent a response.
The Agent stopped responding after Apply & Restart
Open the Agent and check its current condition.
- Initializing: wait for startup to finish.
- Disconnected: inspect Logs for platform or credential failures.
- Needs attention: correct the reported configuration problem, select Apply, and then select Start.
- Working: repeat the test with an explicit mention inside an allowed location.
The Agent responds too broadly
Replace Open policies with allowlists, restrict direct messages, narrow Discord users or roles, and keep mention gating enabled.
Restart the Agent so the regenerated Runtime configuration contains the narrower policy.
Next steps
After configuring channel access: