External chat surfaces

What this is

A Connection for one of those four platforms becomes a chat surface. Grant it to an AI Employee and a direct message or an @-mention reaches the same employee, with the same Soul and Skills, as the chat inside Genosyn. Nothing is duplicated: the thread you have in Slack is a Conversation on that AI Employee, readable in the app, with the same history replayed into every turn.

All four surfaces run on one shared core, so the rules below are identical whichever platform someone messages from. What differs is only how the messages arrive.

Link your account first

This is the part every person hits, so it is worth understanding before you connect anything. The first time you message an AI Employee on one of these surfaces, Genosyn has no idea who you are — it has a Slack user id, not a colleague. So it answers you as a stranger, and adds a short footer with a link.

Before you link

No Soul, no Skills, no Goals, no Policies, no company data, and no company tools — it is not even told its own name. It answers from the conversation in front of it, the way a stranger in the lobby should be answered.

After you link

Exactly your own access, and not one step more. The same company context you see in the app, Finance narrowed by your finance access, and the surfaces that are admin-only in Genosyn still admin-only here.

Open the link the employee sent you, in a browser where you are already signed in to Genosyn. The page names the chat account it is about to link — the platform and the handle — and waits for you to confirm. Your session is the proof. The link is single-use and expires in fifteen minutes; if you miss it, send another message and you get a fresh one.

Why Genosyn does not just trust the email

Slack and Microsoft Teams both report an email address for the person typing, and matching that against your Member list would make all of this disappear. Genosyn deliberately does not do it.

The reason is who else is in the room. Slack Connect puts people from other companies in your channels; Microsoft Teams federation does the same across tenants. Those guests carry real, verified addresses — verified by their organisation, which is not yours. Trusting the claim means trusting every tenant that can reach your workspace to decide who works at your company. A contractor, a customer, or anyone who talked their way into a shared channel would be handed your tools.

So the bind is the one thing that cannot be vouched for from outside: a browser session on your Genosyn account. The platform tells us where the message came from; you tell us who you are.

A binding is cheap to revoke and revokes itself when it should. You can cut your own link whenever you like, an admin can cut anyone's, and losing your Membership drops the binding on the very next message with no cleanup step — the same person, the same Slack account, the same DM history, and none of the company's authority. Signing out everywhere or resetting your password drops it too: those are the things you reach for when you think you have been compromised, so they reach this surface as well. The AI Employee offers you a fresh link on your next message.

Which surfaces work on which install

Two of the four dial out to their platform, which means they work from a laptop behind NAT with nothing published. The other two are webhook-only: the platform has to be able to POST to you, so their cards in the catalog stay disabled until Admin → General → Public URL is set.

A disabled card says so and tells you what to fix. Save a public URL and both become connectable on the next page load — there is no restart.

Setting up each surface

Every one of them ends the same way: open Settings → Integrations, connect the provider, then grant that Connection to an AI Employee at the employee's Settings → Connections. Until a grant exists, the surface replies with a one-line note telling you to add one.

Slack

1. At api.slack.com/apps, click Create New App → From scratch and pick your workspace.
2. Under OAuth & Permissions, add the Bot Token Scopes app_mentions:read, chat:write, im:history, im:read, im:write, channels:history, groups:history, channels:read and reactions:write.
3. Under Socket Mode, turn it on. That generates an app-level token (xapp-…) with connections:write — copy it.
4. Under Event Subscriptions, turn events on and subscribe the app's bot user to app_mention and message.im.
5. Click Install to Workspace, then copy the Bot User OAuth Token (xoxb-…).
6. In Genosyn, connect Slack and paste both: Bot token and App-level token. Leave Signing secret empty.
7. Grant the Connection to an AI Employee, then DM the app in Slack, or invite it to a channel and @-mention it.

Prefer a public URL to a socket? Skip the app-level token, fill in Signing secret instead, and paste the webhook URL Genosyn shows for the Connection into Slack's Event Subscriptions → Request URL. The signature is then the only thing proving a delivery came from Slack, which is why the field is required on that path.

A threaded reply is its own transcript. Two people asking two questions in one channel get two conversations, not one merged blob.

Microsoft Teams

Microsoft Teams is webhook-only, so set Admin → General → Public URL before you start — the catalog card is disabled until you do.

1. In the Azure portal, create an Azure Bot resource. Choose multi-tenant unless you have a reason not to; it creates an Entra app registration for you.
2. Open that Entra app registration and copy its Application (client) ID. Under Certificates & secrets, add a client secret and copy the Value column — the Secret ID will not work.
3. In Genosyn, connect Microsoft Teams and paste both. Fill in Tenant ID only if you registered the bot single-tenant: a multi-tenant bot authenticates against botframework.com, and filling it in is the classic way to break an otherwise perfect secret.
4. Copy the webhook URL Genosyn shows for the Connection into the Azure Bot's Configuration → Messaging endpoint.
5. Under the Azure Bot's Channels, add the Microsoft Teams channel.
6. Build an app package naming that bot id in the Developer Portal for Microsoft Teams, and have a Microsoft Teams administrator install it for the organisation.
7. Grant the Connection to an AI Employee, then message the app or @-mention it.

WhatsApp

Also webhook-only, through the Meta WhatsApp Cloud API, so it needs Admin → General → Public URL too.

1. Create a Meta app of type Business and add the WhatsApp product to it.
2. Under WhatsApp → API Setup, copy the Phone number ID — Meta's id for the sending number, not the number itself.
3. In Business Settings, create a System user and generate a permanent token with whatsapp_business_messaging and whatsapp_business_management. Use that as the Access token; the 24-hour test token on the API Setup page will strand you tomorrow.
4. Copy the App secret from App → Settings → Basic, and invent a long random string for the Verify token.
5. In Genosyn, connect WhatsApp and paste all four fields.
6. Copy the webhook URL Genosyn shows for the Connection into WhatsApp → Configuration → Callback URL, paste the same verify token beside it, click Verify and save, then subscribe to the messages field.
7. Grant the Connection to an AI Employee and message the number.

WhatsApp carries 1:1 conversations only — there is no group inbox to subscribe to. Photos, voice notes and location pins are passed over in silence rather than answered with a complaint about attachments.

Telegram

1. In Telegram, message @BotFather, send /newbot, and give it a name and a username.
2. Copy the token BotFather replies with.
3. In Genosyn, connect Telegram and paste it into Bot token.
4. Grant the Connection to an AI Employee, then DM it. In a group, @-mention it or reply to one of its own messages.

Leave BotFather's Group Privacy on. It limits what the Telegram bot account sees in a group to messages that address it, which is exactly what Genosyn answers anyway.

Who answers

A Connection can be granted to several AI Employees. The one granted it first is the one that answers — deliberately stable, so re-granting a Connection never silently changes who is on the other end.

To reach a different one, start the message with its slug: @finley what is our runway? The prefix is a routing hint and nothing more — only employees already granted that Connection are reachable, so it can never surface an employee the company did not put on that surface.

Channels and groups

• In a DM, it answers everything. A 1:1 thread is a conversation with the AI Employee, and every message gets a reply.
• In a channel or group, only an @-mention. Anything else is somebody else's conversation. Telegram also treats a reply to one of the employee's own messages as addressing it, which is what every other bot in a Telegram group does.
• A group thread has no owner. A DM you are linked on becomes your own history in Genosyn; a transcript several colleagues can read never becomes one Member's private history.

What stays in Genosyn, on purpose

Chat travels. Privileged side effects do not. Two things are missing from these surfaces because they were never meant to be there.

• Approvals. Approving one replays a privileged action the employee already attempted, which is why it is admin-gated and its payload is redacted at every boundary. A chat window is the wrong place to hold something whose whole design is a deliberate human look at a redacted payload — they stay in the Approvals inbox, described under Routines.
• Standdowns. A Standdown is placed and lifted in the app at Settings → Standdowns, and never from chat — a stop the stopped party can talk its way out of is not a stop. While one covers the employee, it stops answering here too, and says so.

Everything else behaves as it does in the app. Grants, Policies, Goals and Decisions are unchanged — a question the employee stops to ask still lands in the Decision stack, and the answer is still given by a human in Genosyn.