Slack approvals

When Thoth holds an action for approval (STEP_UP), it can post the request to a Slack channel, where a reviewer approves or denies it. You choose the channel and the reviewers.

Connect Slack

Installing the Thoth Slack app is a browser step: in Settings, choose Connect Slack and authorize the app in your Slack workspace. Everything after that can be done from thothctl.

thothctl slack status     # the connected workspace and approvals channel
thothctl slack channels   # channels Thoth can post approval requests to

Choose the approvals channel

thothctl slack set-channel --channel-name approvals
# or, by ID:
thothctl slack set-channel --channel-id C0123456789

Choose reviewers

Reviewers are members of your organization with a verified email and an active Slack account under the same email in the connected workspace. List who can be chosen, then set the reviewers by email. set replaces the whole list.

thothctl slack reviewers candidates
thothctl slack reviewers set --email ana@example.com --email ben@example.com
thothctl slack reviewers list    # the reviewers, and whether Slack approvals are ready

thothctl slack reviewers set --none removes every reviewer. Held actions then wait for approval in Thoth until you choose reviewers again.

If someone else changes the reviewers between your read and your save, the save is refused rather than overwriting their change. Run the command again.

From an MCP client

Signed in to the configuration MCP server, an admin's client can read the setup with get_slack_approvals, list who can be chosen with list_slack_reviewer_candidates, and preview a change with preview_slack_approvals (a channel ID, the complete list of reviewer emails, or both). The preview shows the channel and the reviewers by email; you approve it in the browser with a recent second factor. Approvals apply to every agent, so the preview's scope must include every agent.

Who can change this

Changing the channel or the reviewers needs a signed-in admin (thothctl auth login) with a recent second factor, from thothctl or an MCP client. API keys cannot change them, and an MCP client connected with an API key does not see the Slack tools: reviewers decide which held actions run, so a key that leaked could otherwise appoint an approver. For the same reason there is no Terraform resource for reviewers yet; it needs the provider to act as a signed-in user.