Aloware Bot: a teammate in Slack that only reads.

The short version

• Used bySupport, Customer Success, Sales and Engineering, in Aloware's own workspace
• HistoryA thread summarizer since December 2023, rebuilt as an agent in October 2026
• Built276 of 285 commits are mine, and 99.6% of the lines in the code today
• ToolsUp to 16 of its own; an admin who opens an account also gets the account's read-only tools
• WritesNone. Its account tools “can't send, call, edit, buy, enroll or import”
• Tests572 test methods

What people ask it

Mention @Aloware Bot in a thread, or DM it. A thread is one conversation, so a follow-up builds on the answer before. Four commands give a fixed shape: a summary with what is done, in progress and blocked; key points; who has to do what; and the thread's sentiment.

Anything else gets an answer written as it streams in. It can search the web, read PDFs, images and the app alerts posted in a thread, and reply with files, canvases, tables, charts, images or buttons to pick from. Aloware links in Slack turn into cards. The product docs give questions like these:

• “Why did this call go to voicemail?”
• “Does this account show signs of fraud?”
• “Who in the Support inbox can take a call right now?”

How a reply runs

1. Slack sends the event. The server checks Slack's signature over the body, within 5 minutes, and takes a lock on the message so Slack's retries are dropped.
2. A queue job answers. It has one try. A run the worker kills skips its cleanup, so a retry would post the answer twice; instead, a failure posts an apology.
3. Slack is the memory. Each run rebuilds the conversation from the thread: mentions are requests, the bot's messages are its answers, and everything else is context.
4. The answer streams through Slack's agent view: a card per tool call, a Stop button, and Good/Bad buttons at the end. Each request is recorded with its tokens, tool calls, time and outcome.

From summarizer to agent

The bot started in December 2023 with one command, summarize. Key points, action items, sentiment and free-form questions came in 2024. In October 2026 I rebuilt it on the Laravel AI SDK, the first AI agent in our app code, and it now shares its table, chart, file and question tools with the AI Assistant.

The rebuild started from a timing bug. The old driver retried every failure 10 times, behind a 10-minute timeout that the 90-second worker never honored. The new one uses a fast model at low reasoning effort with a 30-second request timeout, so two attempts fit inside the worker's 90 seconds.

Sentiment became a classification instead of a generation. A classifier picks the label in about 0.3 seconds. Above 60% confidence the bot posts the verdict; below it, the reply says the sentiment is unclear and shows the split, instead of a model's explanation stretching to fit one label.

Reading an account, for our admins only

Aloware admins can ask about a customer's account from Slack. The bot matches the asker to an admin by their Slack account, and then:

• Only in our own channels. Admin tools are never offered in a channel shared with another organization. A missing “shared” flag counts as shared.
• Only an explicit list. The admin tools are named one by one, so a write tool added to the server later is not offered in Slack by accident.
• Read-only and free. Opening an account adds the same read-only reader our Super Admin chat uses, filtered to tools that change nothing and cost nothing.
• Audited. Every read is recorded under the admin who asked.

Keeping account data in Slack

A thread, a file or a web page can contain text written to steer the model. The risk worth designing for is that text getting account data into a search query or an image URL. The guards:

• Account data and the web never share a reply. Once a reply has read account data, web search and images are off for the rest of it.
• Only mentions are requests. The rest of the thread is context, and a person's request sits in the user turn, not the system instructions, so it carries no system-prompt weight.
• Names are capped. Anyone can set their own Slack name, so names are cut to 80 characters before they reach an image prompt.
• No crowd pings. @here, @channel and group mentions in a reply are muted.
• Private stays private. An image from another conversation is used only if it's in a public channel the asker belongs to, and every refusal reads the same so it reveals nothing. A planned “summarize this link” command was dropped because a link could expose a private channel.
• Less kept. Message text stays out of logs and error reports, the model provider's storage is off, and the bot's token is only ever sent to Slack's file host.

The same consent, asked in a different place

One tool runs in both the bot and the AI Assistant: sending a feature request to our team. In the AI Assistant, the request waits on an approval card showing exactly what will be sent. In Slack, the bot offers to send it and sends once the person agrees in the thread. A test pins that difference, so a change to one doesn't quietly change the other.

• Classifier-gated agent actions→200 cases against the classifier that lets an AI agent act without asking: its blind spot, and the per-value check that fixed most of it.
• An AI assistant that works the account→A chat panel that answers from an account's own data and changes it, on the same tools as our MCP server, measured fix by fix.
• Aloware MCP→167 tools that let Claude work inside an Aloware account as the person who signed in, with the page's own permission checks.