arizuko › products › Slack team agent

Slack team agent

One agent in your team’s Slack, but not one shared user. arizuko keeps the channel’s persona and thread context shared while each teammate gets their own memory, grant rules, and private web chat. The whole system runs on your server; default outbound traffic is the chat platform and the Anthropic API.

why existing options miss

Most team Slack bots collapse everyone into one prompt or push everyone back into separate per-seat chat apps. Neither is what you want once a team starts depending on an agent.

• A shared ChatGPT or Claude login — everyone shares one conversational context, one trust boundary, one credential set. No per-user memory, no per-user grants behind a shared channel presence.
• Per-seat AI subscriptions — these work well for individual chat. They do not give you a team-visible Slack thread where the persona is channel-scoped but actions still resolve through each teammate’s own memory and grants.
• Rolling your own — then you own the Slack adapter, routing, OAuth account linking, WebDAV surface, dashboard, and egress sandbox. In arizuko those are separate daemons (slakd, proxyd, gated, davd, dashd, crackbox) with file-backed state under one instance directory.

system shape

• Channel as workspace. A Slack channel maps to an arizuko group folder. The product ships its base persona and rules in ~/.claude/CLAUDE.md; the channel’s own ~/CLAUDE.md overrides and extends them — allowed tools, citation rules, refusals, voice for this channel. #eng-support behaves differently from #design from #incidents. The folder mounts at /dav/<channel>/ over WebDAV — edit in Finder, rclone, or any editor.
• Per-user memory. The agent maintains a memory file per teammate (users/<channel>-<id>.md inside the channel folder) — preferences, recurring tasks, prior conclusions. Alice has hers, Bob has his.
• Per-user grants. Per-user grant rules decide which actions each member can ask the agent to take. A teammate’s sub-folder (e.g. eng/alice/) inherits from the channel and overrides only what differs — tweak one skill, keep everything else.
• Linked identities. GitHub, Google, Discord, and Telegram logins resolve to the same user record so the same person reaches the same memory and grants across surfaces.
• Private web workspace. The same channel exposes a token-bound slink URL — a browser chat against the same agent. Take the conversation off Slack onto a phone or laptop without losing context.
• Operator dashboard. /dash/ for grants, routing, scheduled tasks, admission queue, and per-channel health.
• Customisable, upgradable in place. Persona, skills, and channel rules are plain Markdown you (or the agent) edit anytime via WebDAV or chat. Each release ships migrations that the agent applies as a per-group 3-way merge — your local edits survive upstream changes. No SaaS wipe-and-redeploy: customise as deeply as you want, still get every release.

example: shared thread, user-scoped state

#eng-support · thread

  alice  @bot summarize the fix from the cold-start runbook for this thread
  bot    Bundle growth after deploy is coming from broad SDK imports.
         Recommended: switch back to per-service imports.
         source: /docs/runbooks/lambda-cold-start.md:67

  bob    @bot save that conclusion to my notes
  bot    Wrote notes/lambda-cold-start.md in your user area.

  alice  @bot remember: prefer per-service imports for any new lambda
  bot    Saved to your memory.

Same thread, same channel CLAUDE.md, different resolved user state. The answer is visible to the team; Bob’s write lands in Bob’s user area; Alice’s preference lands in her memory file. Shared deliberation, user-scoped state. None of Bob’s notes are visible to Alice; none of either user’s memory leaks into the channel’s shared context.

data & trust

• Your server. Conversation history, channel files, per-user memory, channel-scoped secrets, agent state — all live under /srv/data/arizuko_<name>/. Backup is one tar of the directory; no DB dump.
• Default outbound paths. Slack for bot traffic; Anthropic for model calls. Any extra agent egress goes through crackbox and only reaches hosts you allowlist per channel.
• Channel-scoped secrets stay out of the agent. API keys for tools the agent calls live in the secrets table (AES-GCM at rest with AUTH_SECRET) and are held by the crackbox egress proxy. The container sees only an opaque placeholder; the real value is substituted into outbound HTTP headers or body at egress, scoped to allowed domains. The agent never has the real secret — it can’t leak what it doesn’t have.
• Channel boundary. A teammate in #eng-support sees that channel’s context and their own user area; #design’s files and persona are inaccessible unless granted explicitly.

setup

arizuko create acme
cd /srv/data/arizuko_acme
$EDITOR .env             # set Slack/Discord/Telegram tokens; enable the adapters you want
arizuko run acme

# in Slack:
#   create the Slack App, set bot token + signing secret in .env
#   subscribe events to https://<your-host>/slack/events
#   invite the bot to a channel; teammates sign in via OAuth at /auth/login
#   linked identities resolve to the same user record; per-user state goes live

Full step-by-step is in the deployment guide. Per-channel CLAUDE.md override lives in the channel folder; edit via WebDAV or directly on the server. Channel-scoped API keys live in the encrypted secrets table; the egress proxy substitutes them into outbound requests so the container itself never holds them.

go deeper

• arizuko platform overview — the primitives this product is built on
• grants — per-user and per-group action scoping
• auth — OAuth providers, account linking, identity resolution
• webdav — mounting the channel workspace
• crackbox — per-channel egress isolation
• deployment guide — first instance, first channel, first invite