Type: Connector disposition
Subject: Hex (Slack app)
Decision requested: Approve the proposed disposition for Hex (Slack app) across its 3 assessed actions
Inherent / residual: Critical / Moderate
Control owner: Slack Workspace Admin + Hex Workspace Admin
Context: 3 assessed actions. No Claude runtime control on this path. Administrative actions proposed: Do not enable x1, Permit with restrictions x1, Permit x1. Proposed for Blocked: Scheduled project run delivered to a Slack channel. Class: Slack workspace application (third-party data path - no Claude involvement). Control point: Hex workspace admin (Workspace settings > Integrations) + scheduled-delivery configuration + Slack app approval. Control owner: Slack Workspace Admin + Hex Workspace Admin.
Risks: R-27 [Critical inherent / High residual] Aggregate outbound surface across the estate | R-28 [Critical inherent / High residual] Slack functions as a laundering layer around Claude tool permissions | R-31 [Critical inherent / High residual] Slack is the aggregation point for the enterprise data estate | R-32 [Critical inherent / High residual] Four AI assistants share the same Slack channels | R-33 [High inherent / High residual] Data-platform output delivered into Slack channels | R-38 [Critical inherent / Critical residual] Slack holds no business associate agreement with any Marketplace application provider
Open verification: V-04 [Critical] Every scheduled project delivery: destination channel, schedule, and the columns the output actually contains.
Ruling:
Amendment or condition: