> ## Documentation Index
> Fetch the complete documentation index at: https://control-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Slack and Gmail for agents

> Connect a workspace Slack or Gmail account so Control agents can read bounded context and propose actions that an Owner or Admin approves.

export const ControlAppLink = ({path, breadcrumb, children}) => {
  const link = <a href={`https://app.control.dev${path}`} target="_blank" rel="noopener noreferrer" aria-label={breadcrumb ? `Open ${breadcrumb} in Control` : undefined}>
      {children}
    </a>;
  return breadcrumb ? <Tooltip tip={breadcrumb}>{link}</Tooltip> : link;
};

Control agents use tenant-scoped Slack and Gmail connections to read bounded workspace context. Agents can propose messages and drafts, but nothing is sent until an Owner or Admin approves. Use these connections when you want an agent to reference recent Slack discussion or mailbox context inside a task, or to prepare a message or email that a human reviews before it goes out.

## Before you start

* Only tenant Owners and Admins can connect, reconnect, or revoke an agent integration. The **Connect**, **Reconnect**, and **Remove** buttons are disabled for other roles.
* Agent integrations must be enabled for your workspace. If they are not, the settings section shows **Agent integrations are not enabled in this environment.**
* Allow pop-ups for Control in your browser. The provider consent screen opens in a new window.

## Connect Slack or Gmail

1. Open <ControlAppLink path="/settings#agent-integrations" breadcrumb="Settings → Agent integrations"><strong>Agent integrations</strong></ControlAppLink>.
2. On the Slack or Gmail card, choose **Connect**. A new window opens the provider's hosted consent screen.
3. Sign in to the intended workspace account and approve the permissions.
4. Return to Control. The card updates to **Connected** as soon as the provider confirms the connection.

<Note>
  The connection is workspace-scoped: it belongs to the Control tenant, not to the individual user who created it. Any
  Control user with access to the workspace can trigger agents that use it, subject to the agent's own tool policy.
</Note>

Each connection request is a short-lived intent. If you do not finish the provider consent within 30 minutes, the intent expires and you need to start again from **Connect**.

## Permissions granted

Control uses [Nango](https://www.nango.dev) to run the OAuth flow and store credentials. The provider scopes you approve determine what agents can read and propose:

| Provider | What agents can do with the connection                                                                                         |
| -------- | ------------------------------------------------------------------------------------------------------------------------------ |
| Slack    | Read channels and messages the workspace bot is added to, and prepare messages for review. Nothing is posted without approval. |
| Gmail    | Search the connected mailbox for relevant threads, and prepare draft replies or new emails. Nothing is sent without approval.  |

The exact scope list is shown by the provider on the consent screen. Review it before approving.

## Reconnect

Providers can invalidate a token if the granting user's access changes or if a workspace admin revokes it. When that happens the card shows **Reconnect required**.

1. Open <ControlAppLink path="/settings#agent-integrations" breadcrumb="Settings → Agent integrations"><strong>Agent integrations</strong></ControlAppLink>.
2. Choose the reconnect icon on the affected connection.
3. Complete the provider consent screen in the new window.

Reconnecting replaces the stored token in place. It does not change the connection's identifier or any agent configuration that references it.

## Revoke

Remove a connection when you no longer want agents to read from that workspace account, or as part of offboarding.

1. Open <ControlAppLink path="/settings#agent-integrations" breadcrumb="Settings → Agent integrations"><strong>Agent integrations</strong></ControlAppLink>.
2. Choose the remove icon on the connection.
3. Confirm the prompt.

Control revokes the credential at the provider and marks the connection as revoked in the workspace. Agents can no longer use it. To reinstate access, connect the integration again from scratch.

<Note>
  Revoking an agent integration does not affect any accounting or CRM data source. Slack and Gmail connections are
  managed separately from the connections used for financial data imports.
</Note>

## How agents use the connection

Agents that need Slack or Gmail context call read-only tools through Control's MCP server. Anything that would send a message, post to a channel, or deliver an email is exposed to the agent as a proposal only:

* The agent submits a proposal with the exact payload it wants to send.
* Control records the proposal and holds it in the approval queue.
* An Owner or Admin reviews the payload and approves or rejects it.
* Only after approval does Control deliver the message or draft through the connected account.

This boundary is enforced by the server. An agent cannot send messages, post to channels, or deliver emails without an approval step, regardless of what the client-side prompt says.

## Troubleshooting

* **The Connect button is disabled.** Your role does not have permission. Ask an Owner or Admin to connect the integration.
* **Nothing happened after Connect.** Check that your browser allowed the pop-up window for Control, then try again.
* **The connection flow did not complete.** The intent expires after 30 minutes. Start again from **Connect**.
* **The card shows Reconnect required.** The provider invalidated the token. Use **Reconnect** to reauthorize.
* **Agent integrations are not enabled in this environment.** The feature flag is off for your workspace. Contact Control support to request enablement.