expanso-io Secure Slack Pipeline
A complete security-composed Slack reader pipeline demonstrating all Expanso Edge security stages in a single pipeline.
Architecture
Request → Auth Verify → Input Validate → Access Gate → Slack API →
Error Check → PII Redact → Data Fence → Envelope → Audit Log
All stages run inside a single Expanso pipeline — no shell piping, no external orchestration.
Security Stages
| Stage | What It Does |
|---|---|
| Auth Verify | Validates API key, derives agent identity from credential |
| Input Validate | Rejects malformed channel IDs, caps limit range |
| Access Gate | Deny-by-default permission check against ACCESS_POLICY |
| Error Check | Verifies Slack API returned ok: true |
| PII Redact | Strips emails, phone numbers, SSNs from message text |
| Data Fence | Limits fields to id, text, timestamp only |
| Canonical Envelope | Standard output shape (source, resource, schema_version, data) |
| Audit Log | Structured log of agent, resource, count, trace_id |
Usage
# Set up credentials and policy
export SLACK_BOT_TOKEN=xoxb-...
export EXPANSO_API_KEYS="key123:marketing-bot,key456:data-analyst"
export ACCESS_POLICY="marketing-bot:slack-read:read,data-analyst:slack-read:read"
# Start the pipeline
expanso-edge run pipeline.yaml
# Call it (from your agent or curl)
curl -X POST http://localhost:4195/secure-slack-read \
-H "X-Expanso-Api-Key: key123" \
-H "Content-Type: application/json" \
-d '{"channel":"C01234567","limit":10}'
Output
{
"source": "slack",
"resource": "conversations.history",
"schema_version": "1.0",
"trace_id": "abc123...",
"agent": "marketing-bot",
"data": [
{"id": "1234.5678", "text": "Meeting with [EMAIL] at 3pm", "timestamp": "1234.5678"}
],
"count": 1,
"sensitivity": "redacted"
}
Note: PII has been redacted (email replaced with [EMAIL]), and only allowed fields (id, text, timestamp) are exposed.
Why This Matters
Traditional integrations give AI agents raw credentials and unrestricted data access. This pipeline ensures:
- Agent identity is verified — not trusted from the payload
- Permissions are enforced — deny-by-default, explicit policy required
- Sensitive data is stripped — before the agent ever sees it
- Every access is logged — with agent identity and trace ID
- Credentials stay local — SLACK_BOT_TOKEN never leaves the edge node