Limits and Guardrails
What SAM can reach, what it can change, what it costs you, and what we store.
This is a public, customer-installed Slack app running on your own data.
Tenancy
- Your Slack workspace is connected to exactly one Surface environment, chosen at connect time by someone who can log into Surface.
- Every tool SAM has reads that environment. There is no tenant argument it could pass, and no path to another customer's data.
- Approval clicks are checked against the workspace that owns the pending action. A click from elsewhere reads as not found, not forbidden, so it never confirms to an outsider that the action exists.
- In Slack Connect channels the gate is on who is asking, per channel.
Permissions
| Control | Who sets it | Effect |
|---|---|---|
| Capability modules | Surface admin | A tool outside an enabled module is never shown to the model, so it cannot be called |
| Writes enabled | Surface admin and the OAuth grant | Both must agree. If either is off, SAM is fully read-only, and it says so |
| Daily question limit | Surface admin | 200 by default, rolling 24 hours |
| Who can approve a change | Fixed | The person who asked, or any Slack workspace admin |
Three tools are never exposed to a customer whatever the configuration: creating environments, inviting members, and filing feedback tickets.
The Approval Gate
Anything not explicitly marked read-only waits behind an Approve/Cancel card. The gate reads the tool's own annotation rather than a hand-maintained list of dangerous operations, so a brand-new tool defaults to needs approval.
- The card carries the finished change. A placeholder or half-filled payload is bounced before any card is posted.
- The database row, not the card, is the source of truth. A double-click can't run a change twice; a lost card can't strand a half-done write.
- Editing published content edits the draft. Publishing is a second approval.
- One exception: the Save in Vault button is the approval, with no
second card. It only ever creates a new dated document under
slack/and can't overwrite or delete anything.
Stopping Mid-flight
Every status line carries a Stop button while SAM is working. A stopped turn changes nothing: writes were already waiting behind approval cards. Background jobs carry the same button on their progress card.
Budgets
| Budget | Value |
|---|---|
| Questions per workspace | 200 / rolling 24h |
| Spend per question | $5 ceiling, including generated images |
| Reasoning steps per question | 15, with 4 lookups per step |
| Background jobs | 20 / rolling 24h · 2 concurrent · $12 and ~18 minutes each · 12 items max |
| Web searches / page reads | 3 each per question; 10 / 20 per background job |
| Images in / out | 8 read per message (5 MB each), 4 generated per request |
| Text files | 50,000 characters |
| Schedules | 10 per workspace |
Hitting a cap always produces a message ("that question got too big for one go, try narrowing it down"), never silence.
Reaching the Outside World
Page fetching is https only, follows at most 3 redirects, caps at 2 MB and 10
seconds, and re-checks the resolved IP on every hop against private and
link-local ranges. It cannot be talked into reading an internal address.
What Is Stored
| Stored | Where and why |
|---|---|
| The question, the answer, status, tools used, cost, tokens, URLs fetched | One row per question, which powers the daily cap, the usage tool and our dashboards. Question and answer text also ride along on the product-analytics event, both cut at 4,000 characters. Tool results, meaning your Surface data in bulk, are never sent |
| Memory documents | Per workspace or channel. Fully visible and deletable in App Home |
| Schedules | Prompt, cadence, slot, target channel |
| Pending changes | Until approved or cancelled |
| Slack bot token, Surface OAuth grant | Encrypted. /surface disconnect revokes the Surface grant immediately |
Uninstalling marks the workspace as gone rather than deleting it, so install history survives for support. SAM stops responding.
Ready to Get Started?
See it on your own site, or open the app and build the first form.