AI agents in group chats: roles, permissions and keeping secrets out

Putting AI agents into your team’s group chat turns the chat into a working space: people ask, agents do, progress and approvals appear in the same thread everyone already reads. It also raises questions a one-on-one chat never does. Can the apprentice tell the agent to email a customer? Should the agent see the thread where you discuss staff? What happens when someone pastes a client’s bank details into the group?

The answer is a small amount of structure: roles, a clear rule for who can instruct and approve, platform settings that match, and a short etiquette card. This article sets those out. It builds on our guide to running your business from chat.

Roles when people and agents share a chat

Write the roles down by name and pin them. The agent should know them too: if a contributor asks it to send a customer email, the right behaviour is to draft it and route the approval to the approver, not to refuse and not to send.

Who can give an AI agent in a group chat instructions

Ambiguity about who is in charge is the main source of trouble in shared threads. Three rules cover almost every case:

1. Anyone can request internal work — look this up, draft that, add a note, remind me — because it changes nothing outside the business.
2. Only approvers can trigger outward actions, and only in their area. Everyone else’s request becomes a draft waiting for the right approver.
3. Conflicting instructions go to the owner. If one person says “send the quote today” and another says “hold it”, the agent stops and asks the owner rather than picking a side.

Make instructions explicit by addressing the agent by name or mention. “Someone should chase the Henderson quote” is a conversation; “@Karla chase the Henderson quote” is an instruction. That convention also lines up with how bot privacy works on several platforms.

What the agent can see versus what it can do

Two separate controls are at play, and it helps to keep them apart. Chat membership and platform settings decide what the agent hears. Its connections to your systems decide what it can do. Being in the Accounts group does not give an agent access to the bank feed; only a connection does. Review both.

• Telegram: bots in groups run in privacy mode by default and see only commands, mentions and replies to their own messages, unless they are made admins, in which case they receive all messages (Telegram bot features).
• Discord: reading general message content is a privileged intent; without it a bot still sees direct messages and messages that mention it (Discord documentation).
• Slack: an app sees the channels it has been added to, so add it only where it works.
• WhatsApp: there are no topic threads or bot privacy modes in ordinary groups, so control what the agent hears by keeping separate, small groups.

On the “do” side, apply least privilege: connect only the inboxes, folders and records each area of work needs. Our security series covers that in least-privilege access for AI agents. The platform comparison is in Telegram vs WhatsApp vs Slack vs Discord, and Telegram-specific set-up is in the Telegram guide.

Keeping secrets out of shared threads

A shared workspace doesn’t mean sharing every secret. Group threads are read by many people, on many phones, and often kept for years. Agree what never goes in them:

• Passwords, one-time codes, bank logins and full card numbers.
• Health information, NDIS plan details, and other sensitive personal information about clients.
• Identity documents: licences, passports, Medicare cards.
• Staff performance, pay and personal matters.
• Anything said in confidence by a client.

Instead, refer to the record: “@Eva update the plan dates in Sam’s file from the email he sent this morning.” The agent fetches the detail from the connected system; the thread only holds the instruction. This also aligns with the OAIC’s best-practice recommendation not to enter personal information, particularly sensitive information, into publicly available AI tools, and to do due diligence on commercial ones (OAIC guidance).

When someone does post something sensitive — they will — have a reflex: delete the message, ask the agent to remove it from anything it saved, and put the information where it belongs. Treat a serious slip, such as client health details shared to the wrong group, as a possible privacy incident and assess it properly. Our article on the Privacy Act and AI covers the obligations in general terms.

Etiquette that keeps the thread useful

Ask the agent to follow the same etiquette in reverse: short messages, answer first, one decision per message, and progress updates only when something changes. A daily summary in its own thread beats a stream of “still working on it”.

When to split a thread

One group for everything works for about a week. Split when you see these signs:

• People mute the group because most messages aren’t for them.
• Approvals get lost among chatter. Give approvals or each area its own topic or channel.
• Different audiences — crew, office, management — need different information.
• Outsiders join, such as a contractor or client. Create a separate group and decide whether the agent belongs there at all.
• A project is big enough to have its own plan and hand-offs. Give it its own thread, so the plan, hand-offs and outcome stay together.

On Telegram, topics inside one group make splitting cheap. On Slack and Discord, use channels. On WhatsApp, create separate small groups — our WhatsApp guide covers how to structure them.

Groups that include clients or contractors

Be most careful with groups that include people outside the business. Our default is to keep the agent out of them and run a parallel internal thread where you ask it to draft replies for you to post. If it must be present, use mention-only settings where the platform has them, tell everyone an AI agent is in the group, and make sure it never posts without approval. A client should never be surprised to learn a machine was reading.

Behind the chat, Fulcrum Sessions keeps track of which person or agent owns each part of a request, and the channels page shows how group threads work in each app.