Choose who can talk to an agent
The Access section of an agent's Settings tab decides who can talk to the agent in Slack and by email. It also holds the agent's owners.
Access is in beta. Ask your Willow contact to enable it for your organization. Until it is enabled, the Access section is hidden, and agents decide who can talk to them as they always have.
How it works
Before the agent runs, Willow checks every Slack message and email a person sends against the agent's Access. A message from someone who isn't allowed never reaches the agent.
- Owners and the addresses under Always allow these people always get in.
- Access replaces each mode's Allow external users in Slack switch.
- Each agent starts with Access matching who could already talk to it. See When Access is first enabled.
- Runs that no person starts aren't checked. See What Access doesn't cover.
Set up Access
- Open the agent, select the Settings tab, then Access.
- Answer the two questions under Who can talk to agent name, and add any addresses that should always get in.
- Select Save access. Discard undoes unsaved changes.
Save access also saves the Tell people without access who to ask switch. Changes to the owners save on their own.
People at your organization
| Choice | Who gets in |
|---|---|
| Everyone at your organization | In Slack, anyone in your organization's workspace, guests included, with or without a Willow account. By email, anyone with a Willow account. |
| Only specific groups or people | The Willow groups and users you pick with Add groups or people. Pick at least one before you save. |
With Only specific groups or people, Willow matches the sender's Slack profile email or email address to a Willow user. If there's no match, the sender is turned away.
People outside your organization
These are people from other companies:
- In Slack, anyone Slack reports as being from another workspace, such as Slack Connect users in a shared channel, and anyone Slack can't look up.
- By email, any address that isn't a Willow user in your organization.
In Slack and By email can be ticked together.
| Choice | Who gets in |
|---|---|
| No one | Nobody. Clears both ticks. |
| In Slack | People in every channel and DM your organization shares with other companies. |
| By email | Email from any address. While it's ticked, the section warns that anyone who finds the agent's email address can run it, using your tools and budget. |
| Everyone | Both. Ticks In Slack and By email. |
Email from a deactivated or machine account is always turned away.
Always allow these people
Paste one or more email addresses, separated by commas, spaces or new lines, and select Add. These people get in even when the choices above would turn them away, and don't need a Willow account.
In Slack, Willow matches the address to the sender's Slack profile email. If the sender's company hides profile emails from other companies, there's no match, and the sender is turned away unless In Slack is ticked. The sender's company controls that email, so only add people from companies you trust.
Who can manage the agent
With Access enabled, the owners list moves from General to Access, under Who can manage agent name. Select Manage to change it.
Owners can always talk to the agent if their Slack or email address matches their Willow account. In Slack, that holds only in your organization's own workspace. From another workspace, an owner counts as someone from another company, because that company controls their profile email.
Tell people without access who to ask
When this switch is on, someone turned away in Slack gets a private note naming the agent's owners, or a Willow admin when it has none:
You don't have access to Deploy Helper yet. Ask Dana Cohen or Amir Katz to add you.
When their Slack profile email doesn't match a Willow account, the note says so.
The switch is on by default. A channel with Reply in thread off never sends the note, because the agent posts nothing there. Willow never replies to an email it turns away.
When Access is first enabled
With the beta on, Willow saves each agent's Access the first time the agent is opened or runs, or Slack looks up where it answers. Nobody gets in who was turned away before:
- People at your organization: Everyone at your organization.
- People outside your organization: In Slack, unless a channel (paused ones included), DM or emoji reaction runs a mode with Allow external users in Slack off. Then No one everywhere, until you tick In Slack. By email starts off, because agents never accepted email from other companies.
- Always allow these people: empty.
What changes elsewhere
With Access enabled for your organization:
| Where | What you see |
|---|---|
| A mode's settings | The Allow external users in Slack switch and the Team only badge are hidden. See Modes. |
| The agent's Overview tab | The Owners card becomes Access: who gets in At your organization and Outside your organization, and Who can manage it. Manage opens the Access section. |
| The agents table | The row action Manage Groups reads Organize in groups. Its dialog says groups only sort the agents list. |
What Access doesn't cover
Access doesn't check runs that no person starts:
- API triggers and the invoke API
- Webhook triggers
- Scheduled triggers
- Slack workflow steps
- Messages posted in Slack by a bot or a workflow
Use limits and budgets to control how much these can run.
Agents without Access
These agents control who can talk to them elsewhere. They have no Access section, and their owners stay in General and on the Owners card:
- Personal agents and the personal Slack agent
- Sprout agents
- Agents on kagent and Claude Tag
Turn the beta off
Turning the beta off restores how agents worked before: the mode switches apply again, only Willow users in your organization can email an agent, and the owners list goes back to General. A saved Access is kept and applies again when the beta comes back on, even if a mode switch changed in between.
Troubleshooting
| Symptom | What to check |
|---|---|
| No Access section | Access is in beta. Ask your Willow contact to enable it. It is also hidden on agents without Access. |
| Save access is greyed out | With Only specific groups or people, add at least one group or person. |
| An owner is turned away | Their Slack or email address must match their Willow account. In another company's Slack, they count as someone from another company. Add their address under Always allow these people. |
| Someone at your organization is turned away with "doesn't match a Willow account" | With Only specific groups or people, their Slack profile email must match a Willow user. Fix the profile email, or add it under Always allow these people. |
| Someone from another company gets in or is turned away unexpectedly | Check People outside your organization, and whether Slack marks the sender as external. |
| A turned-away person gets no note | Check that Tell people without access who to ask is on and the channel has Reply in thread on. Turned-away emails never get a reply. |