---
schema_version: "1"
id: 8e789195de97664aa1f68367a164dd7e759e59a545fbcaff5961a61fe0c97618
title: User Permissions and Roles
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/salesforce-slack-sdk/apex-slack-sdk/guides/orgs-users.md
canonical_url: https://developer.salesforce.com/docs/platform/salesforce-slack-sdk/guide/orgs-users.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: d7108efb9c9923fbd62036f8efe09e9b837f3ffff8aaa1631b767ea0724f10a8
products:
  - Apex SDK for Slack (Beta)
---
# User Permissions and Roles

A Slack user is mapped to a Salesforce user via the proxy layer that connects Slack to Salesforce. The proxy layer provides authorization and org routing capabilities.

When you connect a Slack app to a Salesforce org, a Slack user can perform activities and tasks that are granted to the corresponding Salesforce user. Actions in Slack apps are run in Salesforce within the user's context and follow the user's access rights.

For example, an approval that's sent from Salesforce is routed directly to the approver on Slack, such as the user with the sales director role. Only this Slack user receives the message in Slack and can approve or reject the request.

## Understand Salesforce and Slack Permissions

In Salesforce, you can [control who sees what](https://help.salesforce.com/s/articleView?id=platform.security_data_access.htm&type=5) by using these methods:

- Permission sets and profiles for object-level security
- Permission sets and profiles for field-level security
- Sharing settings for record-level security

Slack users don't have roles and permissions like those defined in Salesforce. However, a Slack user has a role with its own [permissions](https://slack.com/help/articles/1500012572621-Permissions-in-Slack-Connect-channels-) and access. See [Permissions by role in Slack](https://slack.com/help/articles/201314026-Permissions-by-role-in-Slack).

For example, a guest role can be granted permission to send messages and upload files but it can't join a public channel.

## Create Permissions for a Slack App

Admins can [create and assign permissions](https://developer.salesforce.com/docs/platform/salesforce-slack-sdk/guide/setup-your-env.md#enable-user-permissions) in Setup on the **Permission Sets** page. However, if you're distributing your Slack app, it's useful to include a permission to simplify installation and setup for users.

To grant a user access, use the [PermissionSet](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_permissionset.htm#permissionSetUserPermissions_title) metadata type and create a `MyPerms.permissionset-meta.xml` file in the `force-app/main/default/permissionsets/` directory of your project.

```ascii
project
|_myslackapp
      |_force-app/main/default/
            |_ permissionsets/
                  |_ MyPerms.permissionset-meta.xml
            |_ slackapps/
                  |_ MySlackApp.slackapp
                  |_ MySlackApp.slackapp-meta.xml
      |_package.json
      |_sfdx-project.json
```

In the metadata file, include the user permissions you want to assign to users. Use one `<userPermissions>` element for each permission.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
    <hasActivationRequired>false</hasActivationRequired>
    <label>SlackPerms</label>
    <license>Salesforce</license>
    <userPermissions>
        <enabled>true</enabled>
        <name>UserSlackCapabilities</name>
    </userPermissions>
</PermissionSet>
```

**tip:** The Apex SDK sample app provides an example of defining a permission set. See [Sample Apex SDK for Slack App](https://developer.salesforce.com/docs/platform/salesforce-slack-sdk/guide/setup-install-app.md).