Give a shared Slack agent each user's own permissions instead of one API key
Alter (YC S25) builds access control for agents that act for multiple users. When a team agent in Slack connects to the CRM or billing system with one shared API key, it can do anything that key allows no matter who asked; Alter scopes each action to the person asking.
Source
simfinii on Hacker News · 2026-10-21 · Project link
Written in our own words. Credit to the original author. Link checked 2026-10-24.
What they did
Alter (YC S25) builds access control for agents that act for multiple users. When a team agent in Slack connects to the CRM or billing system with one shared API key, it can do anything that key allows no matter who asked; Alter scopes each action to the person asking.
Result (as claimed)
A shared internal agent stops being a back door around each employee's permissions.
Tools they used
Cost: Pricing depends on the tools you pick; check each official pricing page.
Set it up
Map the task
Write the trigger, the inputs, the decisions and the output. Note which steps need a human yes.
Connect the tools
Set up Alter with the narrowest permissions that work. Use a test account or sandbox first.
Build the workflow
Create the steps in order. Add an approval step before anything sends, pays or deletes.
Run it on real but low-stakes data
Run a few times, read every output, and fix prompts or rules that misfire.
Schedule and monitor
Turn on the schedule or trigger, and add a daily summary or alert so you notice failures.
Copy the full setup prompt
Paste into your agent and it will walk you through the setup, asking before anything that sends, posts or spends.
You are helping me set up this AI use case end to end in Claude Code. Goal: Give a shared Slack agent each user's own permissions instead of one API key What the original author did: Alter (YC S25) builds access control for agents that act for multiple users. When a team agent in Slack connects to the CRM or billing system with one shared API key, it can do anything that key allows no matter who asked; Alter scopes each action to the person asking. Reported result (as claimed by the author): A shared internal agent stops being a back door around each employee's permissions. Source: https://news.ycombinator.com/item?id=50176908 Tools they used: Alter Category: Automation & business Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Codex. Goal: Give a shared Slack agent each user's own permissions instead of one API key What the original author did: Alter (YC S25) builds access control for agents that act for multiple users. When a team agent in Slack connects to the CRM or billing system with one shared API key, it can do anything that key allows no matter who asked; Alter scopes each action to the person asking. Reported result (as claimed by the author): A shared internal agent stops being a back door around each employee's permissions. Source: https://news.ycombinator.com/item?id=50176908 Tools they used: Alter Category: Automation & business Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Grok Bot. Goal: Give a shared Slack agent each user's own permissions instead of one API key What the original author did: Alter (YC S25) builds access control for agents that act for multiple users. When a team agent in Slack connects to the CRM or billing system with one shared API key, it can do anything that key allows no matter who asked; Alter scopes each action to the person asking. Reported result (as claimed by the author): A shared internal agent stops being a back door around each employee's permissions. Source: https://news.ycombinator.com/item?id=50176908 Tools they used: Alter Category: Automation & business Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
The Daily 5
Get five new use cases tomorrow morning
Free. Real sources. Unsubscribe any time.
Guides for this use case
How to share passwords and logins with an AI agent safely · How to find leads and automate sales outreach with AI agents · How to use AI agents for taxes, bills and budgets · How to run multiple coding agents together
Related use cases
Give each bot a daily budget and permission to stop
32Bridger shared a setup for Grok Bots that run out of usage midweek: give each one a daily budget and explicit permission to stop instead of cutting its tasks.
Give your agents on different machines a shared chat room
His Claude Code runs on a VPS, Codex on his Mac and Grok Bot on his phone, and he was copy-pasting between them, so he built a free, open-source, no-sign-up chat where agents can discuss things with each other.
Give your agent a 3D-printing skill and print company gadgets
His team made a /print3D skill so their agent can send models to a 3D printer, and used it to print a company gadget.
Give your AI agent its own email address and send it tasks from WhatsApp
The author runs Hermes Agent so tasks kick off from WhatsApp, then started experimenting with a MessageBird MCP integration to do the same directly from Claude chat.