GridKeeper

Trust & Scopes

Every permission GridKeeper asks for, and why.

Nothing here is theoretical. Each scope below is tied to a real, working check, traced from the Slack API call back to the exact permission it needs. Nothing is requested "just in case."

What GridKeeper never asks for

No scope that reads message content, ever. No scope that lets GridKeeper post, edit, delete, or send anything. No scope that lets GridKeeper install, remove, or approve an app on your behalf. If a future feature would need one of these, that's a different, clearly-labeled product, not GridKeeper.

Bot token scopes

Requested for every connection, regardless of plan.

ScopeWhat it lets GridKeeper see
conversations.connect:manageSlack Connect channel invitations, so pending and outgoing requests can be flagged.
team:readBasic identity of the workspace or org you connected, nothing more.
users:readThe member, guest, and bot roster, needed for two-factor coverage and dormant account checks.
users:read.emailEmail addresses, so a finding names a real person rather than an internal Slack ID.
channels:readPublic channel inventory, for the sharing and Slack Connect exposure checks.
groups:readPrivate channels GridKeeper's bot has actually been added to. This is deliberately partial, GridKeeper cannot see a private channel it hasn't been invited into, and says so on the relevant card rather than guessing at the rest.

User token scopes

What's requested depends on which plan you connect as, GridKeeper only asks for the narrower set your plan can actually use.

ScopeWhat it lets GridKeeper seePlan
users:readIdentifies Owners and Admins by role.Pro+
adminSee the callout below, this one gets its own explanation.Pro+
admin.apps:readWhich apps are installed or requested, and their approval status, org-wide.Grid
admin.conversations:readChannel inventory across every workspace in the org, including externally shared channels.Grid
admin.teams:readEnumerates the workspaces in the org. Every other per-workspace check depends on this running first.Grid
admin.users:readMember and guest roster and roles, org-wide.Grid
admin.workflows:readWhich workflows exist, who owns them, and whether ownership has lapsed.Grid
auditlogs:readRecovers settings Slack exposes no direct getter for, like SSO enforcement, by reading the audit log.Grid

About the admin scope

This is the one scope GridKeeper requests that is broader than strictly read-only in Slack's own permission model, and it's worth being direct about it rather than burying it in a table. On Pro and Business+ plans, it's the only way to see three things: dormant accounts (last login), who installed an app and when, and paid seats nobody's using. Slack doesn't expose any narrower scope for these on those plans. In practice it's read-only: GridKeeper's code contains no write calls to Slack anywhere, which is verifiable in how the product behaves, not just claimed here. On Enterprise Grid, the narrower admin.* scopes above cover the same ground without needing this one at all.