Back to Details

service-itsm-slack-itservice-configure

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Set Up Self Service for Employees on Slack (Employee Service / ITSM)

为员工在Slack上设置自助服务（员工服务/ITSM）

Complete the "Set Up Self Service for Employees on Slack" checklist group — the employee side of Employee Service (ITSM) on Slack, so employees can create and manage their own tickets from Slack. Every operation dispatches through headless-360.
Execute one step at a time. These are real state-changing writes — run one operation, confirm it succeeded, then proceed. Don't batch setup calls into one parallel block.
Step 1 is a blocking gate. The Slack↔Salesforce connection request is Slack-admin-side. Every run, display the Step 1 block and STOP until the user confirms the request was sent — no API call (not even reads) before that. If unconfirmed, Slack setup is not done.
Speak plainly; keep internals in reasoning. Never surface tooling names, raw error codes, internal endpoints, developer names, or record Ids — translate to plain language ("Slack for Employee Service is now on") and refer to users/sites by human-readable Name. Begin each user-facing summary with the stamp 
(via service-itsm-slack-itservice-configure)
.
完成**“为员工在Slack上设置自助服务”清单组——即Slack上员工服务（ITSM）的员工端配置，让员工能够在Slack中创建并管理自己的工单。所有操作均通过headless-360**调度。
请分步执行操作。这些都是会改变系统状态的实际写入操作——执行一个操作，确认成功后再进行下一步。不要将设置调用批量合并到一个并行块中。
步骤1是阻塞性关卡。Slack与Salesforce的连接请求需要由Slack管理员操作。每次运行时，显示步骤1的内容并暂停，直到用户确认请求已发送——在确认之前，不要进行任何API调用（甚至是读取操作）。如果未确认，则Slack设置未完成。
语言直白；内部逻辑仅保留在推理环节。切勿暴露工具名称、原始错误代码、内部端点、开发人员姓名或记录ID——转换为通俗易懂的语言（例如“面向员工服务的Slack现已启用”），并使用易于理解的名称指代用户/站点。面向用户的每个摘要开头都必须添加标记**
(via service-itsm-slack-itservice-configure)
**。

Scope

范围

  • Automated (API): turn on 
    EmployeeServiceSlackEnabled
    ; assign all three core permsets — 
    EmployeeSlackNotifications
     + 
    ItsmPortalUelUserPermset
     + an API-Enabled permset — to each confirmed employee user; list the employee portal; set the Preferred Digital Experience Site (
    SLACK_PREFERRED_SITE
    ). Also read connection status.
  • Guided + delegated: Connect Agentforce to Slack (Step 6) — ensure the IT Service Employee Agent exists (delegate to 
    service-itsm-agentic-setup-employee-agent-configure
    ), read-check the connection, then guide the UI-only writes.
  • Guided, UI-only: the connection request (Part 1, Step 1) + approve/activate (Parts 2 & 3, Step 2, only if the API read can't confirm) + mapping field; agent↔Slack connection + workspace install (Step 6).
  • Out of scope: Slack notification preferences (on/off).
Prerequisite: the org must have Employee Service (ITSM) licensing/permission — 
EmployeeServiceSlackEnabled
is only editable then (see Gotchas). An employee portal should exist or be created via 
experience-portal-create
.
  • 自动化（API）：开启**
    EmployeeServiceSlackEnabled
    ；为每位已确认的员工用户分配三个核心权限集——
    EmployeeSlackNotifications
    ** + 
    ItsmPortalUelUserPermset
     + 一个API启用权限集；列出员工门户；设置首选Digital Experience站点（
    SLACK_PREFERRED_SITE
    ）。同时读取连接状态。
  • 引导式+委托：将Agentforce连接至Slack（步骤6）——确保IT服务员工代理存在（委托给
    service-itsm-agentic-setup-employee-agent-configure
    ），读取检查连接状态，然后引导仅通过UI完成的写入操作。
  • 引导式、仅UI操作：连接请求（第1部分，步骤1）+ 批准/激活（第2和第3部分，步骤2，仅当API读取无法确认时）+ 字段映射；代理与Slack的连接 + 工作区安装（步骤6）。
  • 超出范围：Slack通知偏好设置（开启/关闭）。
前提条件：组织必须拥有员工服务（ITSM）的许可/权限——只有满足此条件时，
EmployeeServiceSlackEnabled
才可编辑（参见注意事项）。应存在员工门户，或通过
experience-portal-create
创建。

Workflow

工作流程

Step 1 — Request the Slack↔Salesforce connection (Slack-admin-side) — BLOCKING GATE

步骤1 — 请求Slack与Salesforce连接（Slack管理员端）——阻塞性关卡

Connecting the org to a Slack workspace starts Slack-admin-side — no Salesforce API. Hard gate: present only Part 1 (request) verbatim, then HALT and wait for the user to confirm ("ok" / "done"); make no API call yet, and if unconfirmed, Slack setup is not done. Don't front-load Salesforce-side approval — you try to confirm that yourself in Step 2.
text
Connecting the org to Slack starts with a Slack-admin-side request — there's no Salesforce API for
it, so I can't do it for you. Do Part 1 now; after that I'll check the Salesforce side myself.

── PART 1 — Request a Salesforce connection in Slack (Slack desktop app) ──
  1. Click your workspace name in the sidebar.
  2. Hover over Tools & settings, then click Manage Salesforce organisations.
  3. Click on Connect Salesforce org in the top-right corner.
  4. Enter your Salesforce org URL.
  5. Choose whether to use Email or SAML NameID for the Account mapping field. If you like,
     toggle Automatic account mapping off to manually map accounts.
  6. Click on Request connection, then click on OK. Your request will be sent to Salesforce for
     approval.

Full walkthrough (all three parts — request, Salesforce approval, Slack activation):
  https://slack.com/intl/en-in/help/articles/30754346665747-Connect-Salesforce-and-Slack

Once you've sent the "Request connection" (Part 1), reply "ok".
将组织连接至Slack工作区需从Slack管理员端发起——无Salesforce API可用。硬性关卡：仅展示第1部分（请求）的原文内容，然后暂停，等待用户确认（回复“ok”/“done”）；在此之前不要进行任何API调用，如果未确认，则Slack设置未完成。不要提前进行Salesforce端的审批——你将在步骤2中自行确认。
text
Connecting the org to Slack starts with a Slack-admin-side request — there's no Salesforce API for
it, so I can't do it for you. Do Part 1 now; after that I'll check the Salesforce side myself.

── PART 1 — Request a Salesforce connection in Slack (Slack desktop app) ──
  1. Click your workspace name in the sidebar.
  2. Hover over Tools & settings, then click Manage Salesforce organisations.
  3. Click on Connect Salesforce org in the top-right corner.
  4. Enter your Salesforce org URL.
  5. Choose whether to use Email or SAML NameID for the Account mapping field. If you like,
     toggle Automatic account mapping off to manually map accounts.
  6. Click on Request connection, then click on OK. Your request will be sent to Salesforce for
     approval.

Full walkthrough (all three parts — request, Salesforce approval, Slack activation):
  https://slack.com/intl/en-in/help/articles/30754346665747-Connect-Salesforce-and-Slack

Once you've sent the "Request connection" (Part 1), reply "ok".

Step 2 — Confirm the connection (try API first), then turn on Slack for Employee Service

步骤2 — 确认连接（优先尝试API），然后开启面向员工服务的Slack

Don't send the user to Salesforce right away — try to confirm the connection yourself first, and only guide the Salesforce-side approve/activate if you can't. Then enable the Employee Service org preference.
2a. TRY TO READ the connection via API (headless users have no Setup UI, so read rather than send them there blind):
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/connect/slackbridge/connections"
)
Returns 
{team:{status, teamName, teamDomain, teamId}, currentUserMapping:{salesforceUserId, slackUserId}}
(verified 
200
). Branch on 
team.status
:
  • CONNECTED
     → already approved and live. Name the workspace by 
    teamName
    ; skip Parts 2 & 3 and go straight to 2c (enable the preference). (A 
    null
    currentUserMapping.salesforceUserId
    means this user isn't mapped to a Slack user yet — mention it; it doesn't block the connection.)
  • team: null
    / not-connected / errors → you CANNOT confirm it yet.     This endpoint is CONNECTED-only and blind to a pending/requested connection, so a null does not mean the request is absent. Never say it "didn't land" or "isn't on the Salesforce side". Say only that no activated connection shows via API yet, then 2b.
2b. Only if you couldn't confirm (team:null / pending), PASTE Part 2 and Part 3, then HALT. Part 2 is the Salesforce-side approval + mapping field (default 
Email
; ask if the org uses SAML) — genuinely UI-only, so guide it, don't fake an approve API. Point the user at the pending view Setup → Manage Slack Connection (
/lightning/setup/SlackWorkspaces/home
). Wait for "ok" (approved + activated) before 2c.
text
── PART 2 — Approve the connection on the Salesforce side (guided) ──
  1. Go to Setup → Manage Slack Connection (/lightning/setup/SlackWorkspaces/home).
  2. Find the pending request and Approve it.
  3. Set the Account mapping field to Email (default) — or SAML NameID if your org uses SAML.

── PART 3 — Activate the connection back in Slack (Slack desktop app) ──
  Do this after the connection is approved on the Salesforce side. Owners / Salesforce-admin system
  role in Slack can activate:
  1. Click your workspace name in the sidebar.
  2. Hover over Tools & settings, then click Manage Salesforce organisations.
  3. Select the pending connection.
  4. Review the connection details, then click Activate.

Reply "ok" once the connection is approved and activated, and I'll continue with the Salesforce setup.
Read yes, approve no — do not fake it. Reading status is real; approving the connection and setting the mapping field are genuinely UI-only. Don't invent a 
/connect/slack…
approve call or claim it approved. Details / API evidence: 
references/manage-slack-connection.md
.
2c. Turn on Slack for Employee Service. A direct org-preference toggle (reachable via 
PATCH
). Enable it yourself via API; don't ask the user to flip the Setup toggle. Read first (idempotent — skip the write if already enabled):
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/setup/org/preferences/EmployeeServiceSlackEnabled"
)
Expect 
200 {"isPreferenceEnabled": <bool>}
. If 
false
, enable it:
text
mcp__headless-360__dispatch(
  method: "PATCH",
  url:    "/services/data/v67.0/setup/org/preferences/EmployeeServiceSlackEnabled",
  body:   { "desiredState": true }
)
Expect 
200 {"isPreferenceEnabled": true}
. Re-run the GET to confirm. Tell the user it's enabled — don't ask them to flip the toggle themselves.
Verified: the REST preference name is 
EmployeeServiceSlackEnabled
 (not the Metadata-API name 
enableEmployeeServiceSlack
; guessed variants 
404
). See Gotchas for the write-access gate.
不要立即引导用户前往Salesforce——优先尝试自行确认连接状态，只有在无法确认时才引导用户完成Salesforce端的批准/激活操作。然后启用员工服务组织偏好设置。
2a. 尝试通过API读取连接状态（无头用户无设置UI，因此优先读取而非盲目引导用户前往设置页面）：
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/connect/slackbridge/connections"
)
返回结果为
{team:{status, teamName, teamDomain, teamId}, currentUserMapping:{salesforceUserId, slackUserId}}
（已验证返回
200
）。根据
team.status
分支处理：
  • CONNECTED
     → 已批准并生效。通过
    teamName
    命名工作区；跳过第2和第3部分，直接进入2c（启用偏好设置）。（如果
    currentUserMapping.salesforceUserId
    为
    null
    ，表示该用户尚未映射到Slack用户——需告知用户，这不会阻碍连接。）
  • team: null
    / 未连接 / 错误 → 无法确认连接状态    。此端点仅在
    CONNECTED
    状态下返回数据，无法检测待处理/已请求的连接，因此
    null
    并不表示请求不存在。切勿告知用户“请求未提交”或“未显示在Salesforce端”。仅需说明“API暂未检测到已激活的连接”，然后执行2b步骤。
2b. 仅在无法确认连接状态时（team:null / 待处理），粘贴第2和第3部分内容，然后暂停。第2部分是Salesforce端的批准 + 字段映射（默认
Email
；询问组织是否使用SAML）——确实只能通过UI完成，因此需引导用户操作，不要伪造批准API。引导用户查看待处理请求页面设置 → 管理Slack连接（
/lightning/setup/SlackWorkspaces/home
）。等待用户回复“ok”（已批准并激活）后再执行2c步骤。
text
── PART 2 — Approve the connection on the Salesforce side (guided) ──
  1. Go to Setup → Manage Slack Connection (/lightning/setup/SlackWorkspaces/home).
  2. Find the pending request and Approve it.
  3. Set the Account mapping field to Email (default) — or SAML NameID if your org uses SAML.

── PART 3 — Activate the connection back in Slack (Slack desktop app) ──
  Do this after the connection is approved on the Salesforce side. Owners / Salesforce-admin system
  role in Slack can activate:
  1. Click your workspace name in the sidebar.
  2. Hover over Tools & settings, then click Manage Salesforce organisations.
  3. Select the pending connection.
  4. Review the connection details, then click Activate.

Reply "ok" once the connection is approved and activated, and I'll continue with the Salesforce setup.
可读取，不可批准——不要伪造操作。读取状态是真实的；批准连接和设置映射字段确实只能通过UI完成。不要虚构
/connect/slack…
批准调用或声称已完成批准。详情/API依据：
references/manage-slack-connection.md
。
2c. 开启面向员工服务的Slack。直接切换组织偏好设置（可通过
PATCH
调用实现）。自行通过API启用；不要让用户手动切换设置开关。先读取状态（幂等操作——如果已启用则跳过写入）：
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/setup/org/preferences/EmployeeServiceSlackEnabled"
)
预期返回
200 {"isPreferenceEnabled": <bool>}
。如果为
false
，则启用：
text
mcp__headless-360__dispatch(
  method: "PATCH",
  url:    "/services/data/v67.0/setup/org/preferences/EmployeeServiceSlackEnabled",
  body:   { "desiredState": true }
)
预期返回
200 {"isPreferenceEnabled": true}
。重新运行GET调用确认状态。告知用户已启用——不要让用户手动切换开关。
已验证：REST偏好设置名称为**
EmployeeServiceSlackEnabled
**（而非Metadata API名称
enableEmployeeServiceSlack
；猜测的变体均返回
404
）。写入权限受
userCanManageEmployees
限制——非ITSM组织的PATCH调用可能被拒绝；需告知用户错误信息，不要重试。

Step 3 — Enable / list the employee portal

步骤3 — 启用/列出员工门户

Slack for Employee Service surfaces self-service through a Digital Experience portal. List the org's sites and confirm an employee portal exists (this list feeds the Preferred Site selection in Step 5):
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/connect/communities"
)
Each entry carries 
id
(the Network Id, 
0DB...
), 
name
, 
status
, 
templateName
, 
siteUrl
. Present the list and identify the employee portal (
templateName
"Employee Portal" / "Agentforce Employee Center"). If no portal exists — or Digital Experiences isn't enabled (the call errors / returns nothing) — hand off to 
experience-portal-create
 (covers org-level enablement too), then return.
面向员工服务的Slack通过Digital Experience门户提供自助服务。列出组织的站点并确认存在员工门户（此列表将用于步骤5中的首选站点选择）：
text
mcp__headless-360__dispatch_readonly(
  method: "GET",
  url:    "/services/data/v67.0/connect/communities"
)
每个条目包含
id
（Network ID，格式为
0DB...
）、
name
、
status
、
templateName
、
siteUrl
。展示列表并识别员工门户（
templateName
为“Employee Portal”/“Agentforce Employee Center”）。如果不存在门户——或Digital Experiences未启用（调用报错/无返回结果）——则委托给**
experience-portal-create
**（也涵盖组织级启用操作），然后返回。

Step 4 — Manage User Access (assign the employee permission sets)

步骤4 — 管理用户访问权限（分配员工权限集）

The Go page's "Manage User Access" step assigns permission sets to each confirmed employee user (never all active users — ask which user(s), then assign). Always assign all three core permsets to each confirmed user — don't ask the user to choose a "notifications-only" vs "full" scope; the three together are what makes Slack for Employee Service actually usable (notifications + record visibility + API access), and under-assigning silently breaks record access:
  • EmployeeSlackNotifications
     — Slack notifications on ticket updates (the core of the step).
  • ItsmPortalUelUserPermset
     ("ITSM Portal Uel User") — read/create/edit on Incident, Service Request, Case (self-service) — lets the employee see/work their own records.
  • API Enabled — lets the Slack app call Connect APIs. Reuse any existing API-Enabled permset the org already has; else create a Slack-named one (
    PermissionSet
    , 
    PermissionsApiEnabled = true
    , e.g. Name 
    Slack_ApiAccess
    / label "Slack API Access"). See 
    references/manage-user-access.md
    .
Agent access is separate and conditional — assign it only if the user opts into the Agentforce agent in Slack (Step 6): the per-agent 
Agent_Access
permset (the agent's 
BotDefinition
SetupEntityAccess
); reverse-lookup, create if absent. Never 
Access_Agents
(fails on an employee license). Mechanics: 
references/connect-agentforce-to-slack.md
.
Warn the user before assigning — their email must match their Slack user's email. The permset grants only the ability to receive notifications; the Salesforce↔Slack link comes from the connection's account-mapping field (default 
Email
): 
User.Email
must equal the Slack-account email, or they map to no Slack user and notifications go nowhere. A 
null
currentUserMapping.salesforceUserId
from Step 2 means unmapped. (SAML NameID: same rule, that identifier.) Surface this before you assign, so the user can pick users whose emails match.
Flow: query active users (page ≤10), classify with the helper script (don't eyeball — early pages are full of system/integration accounts), ask which to grant, look up each permset Id fresh, POST one 
PermissionSetAssignment
per user per permset, classify each response with the script.
→ 
references/manage-user-access.md
 — query + POST bodies, the 
classify-user-access.mjs
contracts, the email-match + license gotchas, and the 
ItsmPortalUelUserPermset
/ API-Enabled / agent-access grants.
Go页面的**“管理用户访问权限”**步骤为每位已确认的员工用户分配权限集（切勿为所有活跃用户分配——询问需分配的用户，然后执行分配）。始终为每位已确认的用户分配全部三个核心权限集——不要让用户选择“仅通知”或“完整权限”范围；这三个权限集共同构成面向员工服务的Slack的可用功能（通知 + 记录可见性 + API访问），分配不足会导致记录访问功能静默失效：
  • EmployeeSlackNotifications
     ——工单更新时发送Slack通知（此步骤的核心）。
  • ItsmPortalUelUserPermset
    （“ITSM Portal Uel User”）——对事件、服务请求、案例（自助服务）的读取/创建/编辑权限——让员工能够查看/处理自己的记录。
  • API Enabled ——允许Slack应用调用Connect API。复用组织中已有的任何API启用权限集；如果没有，则创建一个以Slack命名的权限集（
    PermissionSet
    ，
    PermissionsApiEnabled = true
    ，例如名称
    Slack_ApiAccess
    / 标签“Slack API Access”）。详情参见
    references/manage-user-access.md
    。
代理访问权限是独立且有条件的——仅当用户选择在Slack中启用Agentforce代理时（步骤6）才分配：每个代理专属的
Agent_Access
权限集（代理的
BotDefinition
的
SetupEntityAccess
）；反向查找，不存在则创建。切勿分配
Access_Agents
（员工许可证无法使用此权限集）。实现机制：
references/connect-agentforce-to-slack.md
。
分配前提醒用户——他们的邮箱必须与Slack用户的邮箱匹配。权限集仅授予接收通知的能力；Salesforce与Slack的关联来自连接的账户映射字段（默认**
Email
）：
User.Email
必须等于Slack账户的邮箱，否则无法映射到Slack用户，通知将无法送达。步骤2中返回的
currentUserMapping.salesforceUserId
为
null
表示未映射。（SAML NameID规则相同，需标识符匹配。）在分配前**告知用户此要求，以便用户选择邮箱匹配的用户。
流程：查询活跃用户（每页≤10条），使用辅助脚本分类（不要手动判断——前几页通常包含系统/集成账户），询问需授予权限的用户，重新查找每个权限集的ID，为每个用户的每个权限集发送一个
PermissionSetAssignment
POST请求，使用脚本分类每个响应。
→ 
references/manage-user-access.md
——查询+POST请求体、
classify-user-access.mjs
脚本约定、邮箱匹配+许可证注意事项，以及
ItsmPortalUelUserPermset
/API启用/代理访问权限的分配细节。

Step 5 — Select a Preferred Digital Experience Site to connect Slack with

步骤5 — 选择首选Digital Experience站点以连接Slack

Writes the org value 
SLACK_PREFERRED_SITE
(shared, cross-feature — see Gotchas).
  1. Use the site list from Step 3. Ask which site to connect Slack with; if they don't choose, pick one yourself (the only site, else the employee portal / most recent 
    Live
    site) and tell them.
  2. Read 
    GET /services/data/v67.0/setup/org/values/SLACK_PREFERRED_SITE
    first (
    stringValue
    = current Network 
    Id
    or 
    "None"
    ); skip the write if already the chosen site's Id.
  3. Write via 
    dispatch
    PATCH
    to the same path with body 
    { "orgValue": "<site Network Id>" }
    — the site's Network 
    Id
     (
    0DB...
    from 
    connect/communities
    , not 
    urlPathPrefix
    ); re-read to confirm.
写入组织值
SLACK_PREFERRED_SITE
（共享、跨功能——参见注意事项）。
  1. 使用步骤3中的站点列表。询问用户要将Slack连接至哪个站点；如果用户未选择，则自行选择一个（唯一站点，否则选择员工门户/最新的
    Live
    站点）并告知用户。
  2. 先读取
    GET /services/data/v67.0/setup/org/values/SLACK_PREFERRED_SITE
    （
    stringValue
    = 当前Network 
    Id
    或
    "None"
    ）；如果已为所选站点的ID，则跳过写入。
  3. 通过
    dispatch
    的
    PATCH
    请求写入同一路径，请求体为
    { "orgValue": "<site Network Id>" }
    ——站点的Network 
    Id
    （来自
    connect/communities
    的
    0DB...
    ，不是
    urlPathPrefix
    ）；重新读取以确认。

Step 5b — Verify the site is active, published, and the user is a member (BLOCKING — do before any success)

步骤5b — 验证站点已激活、已发布且用户为站点成员（阻塞性操作——成功前必须执行）

SLACK_PREFERRED_SITE
and the Step-4 permset writes all return 
200/201
even when the site can't serve the employee — a "success" summary is then wrong: IT Service lists come back empty / access-denied. Activation, membership, and publication are three distinct states — verify each; a failure of any is blocking — do not report setup complete. Remediation for any gap is programmatic (hand to 
experience-portal-create
, which owns the activate/add-member/publish paths), UI as fallback — not UI-only:
  1. Live (activation) — 
    SELECT Status FROM Network WHERE Id = '<site Id>'
    ; if 
    != 'Live'
    , hand off.
  2. Member (per Step-4 user) — 
    SELECT Id FROM NetworkMember WHERE NetworkId = '<site Id>' AND MemberId = '<user Id>'
    ; 
    0
    rows → hand off (add the profile/permset to Members).
  3. Published — 
    Network.Status = 'Live'
    does not prove the pages are published (a never-published site 404s); if it was only activated, hand off to publish.
→ 
references/site-membership-verification.md
 — exact queries, remediation, and the silent-success failure mode.
即使站点无法为员工提供服务，
SLACK_PREFERRED_SITE
和步骤4的权限集写入操作仍会返回
200/201
——此时“成功”摘要并不准确：IT服务列表会返回空/访问被拒绝。激活、成员身份和发布是三个独立状态——需分别验证；任何一项失败均为阻塞性操作——不要报告设置完成。任何缺口的修复均为程序化（委托给**
experience-portal-create
**，该流程负责激活/添加成员/发布路径），UI作为备选方案——不要仅依赖UI：
  1. 已激活（Live） ——执行
    SELECT Status FROM Network WHERE Id = '<site Id>'
    ；如果
    != 'Live'
    ，则委托处理。
  2. 成员身份（针对步骤4中的用户）——执行
    SELECT Id FROM NetworkMember WHERE NetworkId = '<site Id>' AND MemberId = '<user Id>'
    ；返回
    0
    行则委托处理（将用户的配置文件/权限集添加至成员）。
  3. 已发布 ——
    Network.Status = 'Live'
    并不代表页面已发布（从未发布的站点会返回404）；如果仅激活未发布，则委托处理发布操作。
→ 
references/site-membership-verification.md
——精确查询语句、修复方法，以及静默成功的失败模式。

Step 6 — Configure Agentforce for Slack (optional; ask the user first — this is the final step)

步骤6 — 为Slack配置Agentforce（可选；先询问用户——这是最后一步）

First, have the user verify their records show in Slack — HALT before Agentforce. Catch a visibility failure here rather than blame it on the agent later:
text
Before we (optionally) add the Agentforce agent, verify records show in Slack:
  1. In Slack → Agents & tools → Apps → search "Salesforce" → Open app.
  2. Confirm your self-service records show — Incident, Service Request, Case lists.

Reply "ok" once you see them. If a list says "Nothing turned up", the self-service permset
(ItsmPortalUelUserPermset) or email mapping isn't right — tell me and we'll fix it first.
Only after the user confirms records are visible, ask whether they also want an Agentforce agent to reply in Slack; if not, stop here — setup is complete without it. If yes, the Go page's Configure Agentforce for Slack group has two items that make an agent actually reply in Slack:
  • "Build and Manage Agent" — the agent build; IS automatable (delegate).
  • "Connect Agentforce to Slack" — connection + workspace install; UI-only (guide).
Ensure the agent exists first — the IT Service Employee Agent. Check the org (query below); if missing, hand off to 
service-itsm-agentic-setup-employee-agent-configure
 (provisions templates, creates, activates), then return. (Fulfiller: 
service-itsm-agentic-setup-fulfiller-agent-configure
.)
text
mcp__headless-360__dispatch_readonly(
  method: "GET", url: "/services/data/v67.0/query",
  queryParams: { "q": "SELECT Id, DeveloperName, MasterLabel FROM BotDefinition WHERE DeveloperName = 'IT_Service_Employee_Agent'" }
)
The connection is UI-only for writes — read-check state first, guide, don't fake it. No public API adds the Slack connection or installs the agent into a workspace. Read-check before sending the user to Setup: workspace connection via Step 2's 
/connect/slackbridge/connections
(
CONNECTED
⇒ live). The agent↔Slack link has no read — eyeball the Builder's Connections node. Then guide whatever's missing.
If the "+" next to Connections isn't clickable, the version is Committed (locked) — connections add only on a Draft. Click New Version first; the + enables (version-lock, not Active/Inactive — deactivating does not unlock). After + → Add connection → Slack → Add to agent: Save → Commit Version → Activate.
→ 
references/connect-agentforce-to-slack.md
 — verbatim click-paths (both sides), manage-after-install actions, prerequisites, and the no-API evidence. Display these to the user.
首先，让用户验证其记录在Slack中可见——配置Agentforce前暂停。在此处捕获可见性问题，避免后续归咎于代理：
text
Before we (optionally) add the Agentforce agent, verify records show in Slack:
  1. In Slack → Agents & tools → Apps → search "Salesforce" → Open app.
  2. Confirm your self-service records show — Incident, Service Request, Case lists.

Reply "ok" once you see them. If a list says "Nothing turned up", the self-service permset
(ItsmPortalUelUserPermset) or email mapping isn't right — tell me and we'll fix it first.
仅在用户确认记录可见后，询问用户是否还需要Agentforce代理在Slack中回复；如果不需要，则在此停止——无需代理即可完成设置。如果需要，则Go页面的为Slack配置Agentforce组包含两项可让代理在Slack中实际回复的操作：
  • “构建并管理代理”——代理构建；可自动化（委托处理）。
  • “将Agentforce连接至Slack”——连接+工作区安装；仅UI操作（引导处理）。
首先确保代理存在——即IT服务员工代理。检查组织（执行以下查询）；如果不存在，则委托给**
service-itsm-agentic-setup-employee-agent-configure
**（提供模板、创建、激活），然后返回。（处理者：
service-itsm-agentic-setup-fulfiller-agent-configure
。）
text
mcp__headless-360__dispatch_readonly(
  method: "GET", url: "/services/data/v67.0/query",
  queryParams: { "q": "SELECT Id, DeveloperName, MasterLabel FROM BotDefinition WHERE DeveloperName = 'IT_Service_Employee_Agent'" }
)
连接写入操作仅支持UI——先读取检查状态，引导操作，不要伪造。没有公开API可添加Slack连接或将代理安装到工作区。引导用户前往设置前先读取检查状态：通过步骤2的
/connect/slackbridge/connections
检查工作区连接（
CONNECTED
⇒ 已生效）。代理与Slack的关联无法通过读取获取——需手动查看Builder的Connections节点。然后引导用户完成缺失的操作。
如果Connections旁的“+”不可点击，则版本为已提交（锁定）——仅草稿版本可添加连接。先点击新版本；“+”将启用（版本锁定，与激活/未激活无关——停用不会解锁）。点击**+ → 添加连接 → Slack → 添加至代理**后：保存 → 提交版本 → 激活。
→ 
references/connect-agentforce-to-slack.md
——逐字点击路径（双方）、安装后管理操作、前提条件，以及无API的依据。将这些内容展示给用户。

Gotchas

注意事项

IssueDetail
REST preference name is 
EmployeeServiceSlackEnabled
, not the Metadata name
/setup/org/preferences/{name}
uses 
EmployeeServiceSlackEnabled
 (Metadata field 
enableEmployeeServiceSlack
differs). Write access is gated (
userCanManageEmployees
) — on a non-ITSM org the PATCH may be rejected; surface the error, don't retry.
SLACK_PREFERRED_SITE
org value
orgValue
= the site's Network 
Id
(
0DB...
), not 
urlPathPrefix
. Read it back after writing to confirm.
slackbridge/connections
is CONNECTED-only — 
team: null
≠ no connection
GET /connect/slackbridge/connections
populates 
team
only after activation; a pending connection reads 
{team: null}
yet exists and shows in Setup → Manage Slack Connection (Aura-only, no REST mirror). Never report a null as "request didn't land"; say "no activated connection visible via API yet" and cross-check Setup. No approve/activate endpoint. Details: 
references/manage-slack-connection.md
.
Version prefix requiredheadless-360 
dispatch
/
dispatch_readonly
don't resolve API versions — pass the full 
/services/data/vXX.0/...
prefix.
Step 4 permset — 
EmployeeSlackNotifications
, not 
SlackServiceUser
; may be license-gated		Assign the employee-side 
EmployeeSlackNotifications
 (+ 
ItsmPortalUelUserPermset
for self-service record visibility — Incident/Service Request/Case, not Problem/Change); 
SlackServiceUser
is a fulfiller-side one that does not satisfy this step. Some licenses can't hold the PSL (
400 FIELD_INTEGRITY_EXCEPTION
) — hard "wrong license" stop, not retryable. Details: 
references/manage-user-access.md
.
Step 4 API-Enabled permset — reuse or createThe user needs a permset with API Enabled for the Slack app to call Connect APIs. Reuse any existing API-Enabled permset the org has; if none, create a minimal Slack-named 
PermissionSet
(
PermissionsApiEnabled = true
, e.g. 
Slack_ApiAccess
). Details: 
references/manage-user-access.md
.
Writes succeed but Slack shows no records → site inactive/unpublished or user not a member
SLACK_PREFERRED_SITE
and permset writes return 
200/201
even when the site is 
UnderConstruction
, its pages are unpublished, or the user has no 
NetworkMember
 row — so "success" is misleading. Step 5b verifies three distinct states (activation 
Network.Status = 'Live'
; a 
NetworkMember
per Step-4 user; publication — 
Live
does not prove pages published) before any success. Remediation is programmatic — hand to 
experience-portal-create
(owns activate/add-member/publish), UI as fallback, not UI-only. Details: 
references/site-membership-verification.md
.
问题详情
REST偏好设置名称为
EmployeeServiceSlackEnabled
，而非Metadata名称
/setup/org/preferences/{name}
使用**
EmployeeServiceSlackEnabled
**（Metadata字段
enableEmployeeServiceSlack
不同）。写入权限受
userCanManageEmployees
限制——非ITSM组织的PATCH调用可能被拒绝；需告知用户错误信息，不要重试。
SLACK_PREFERRED_SITE
组织值
orgValue
= 站点的Network 
Id
（
0DB...
），而非
urlPathPrefix
。写入后重新读取确认。
slackbridge/connections
仅返回CONNECTED状态——
team: null
≠无连接
GET /connect/slackbridge/connections
仅在激活后填充
team
字段；待处理连接会返回
{team: null}
但确实存在，且会显示在设置 → 管理Slack连接（仅Aura可用，无REST镜像）。切勿将
null
报告为“请求未提交”；应说明“API暂未检测到已激活的连接”并交叉检查设置页面。无批准/激活端点。详情：
references/manage-slack-connection.md
。
需要版本前缀headless-360的
dispatch
/
dispatch_readonly
无法解析API版本——需传递完整的
/services/data/vXX.0/...
前缀。
步骤4权限集——
EmployeeSlackNotifications
，而非
SlackServiceUser
；可能受许可证限制		分配员工端的**
EmployeeSlackNotifications
**（+ 
ItsmPortalUelUserPermset
用于自助服务记录可见性——事件/服务请求/案例，而非问题/变更）；
SlackServiceUser
是处理者端权限集，无法满足此步骤要求。部分许可证无法持有该PSL（
400 FIELD_INTEGRITY_EXCEPTION
）——遇到“错误许可证”时需终止操作，不要重试。详情：
references/manage-user-access.md
。
步骤4API启用权限集——复用或创建用户需要一个包含API Enabled的权限集，以便Slack应用调用Connect API。复用组织中已有的任何API启用权限集；如果没有，则创建一个最小化的Slack命名
PermissionSet
（
PermissionsApiEnabled = true
，例如
Slack_ApiAccess
）。详情：
references/manage-user-access.md
。
写入操作成功但Slack无记录显示→站点未激活/未发布或用户非成员即使站点处于
UnderConstruction
、页面未发布或用户无**
NetworkMember
行，
SLACK_PREFERRED_SITE
和权限集写入操作仍会返回
200/201
——因此“成功”具有误导性。步骤5b会在任何成功摘要前验证三个独立状态（激活
Network.Status = 'Live'
；步骤4中的每个用户均为
NetworkMember
；已发布——
Live
并不代表页面已发布）。修复为程序化**——委托给
experience-portal-create
（负责激活/添加成员/发布），UI作为备选方案，不要仅依赖UI。详情：
references/site-membership-verification.md
。

Verification Checklist

验证清单

Before emitting any user-facing summary, confirm each of the following:
  • Step 1 block displayed and the user explicitly confirmed Part 1 was sent before any API call; if not, no step ran and the user was told setup isn't done.
  • Step 2 read 
    /connect/slackbridge/connections
    first; 
    CONNECTED
    → Parts 2 & 3 skipped; a 
    team: null
    phrased as "no activated connection visible via API yet" (+ Setup → Manage Slack Connection), never "request didn't land"; Parts 2 (approve, no fake approve-API) & 3 pasted only if unconfirmed.
  • Output opens with the 
    (via service-itsm-slack-itservice-configure)
    stamp; no tooling names, error codes, endpoints, developer names, or record Ids — names are human-readable.
  • Each write ran one at a time; idempotent reads (
    EmployeeServiceSlackEnabled
    , 
    SLACK_PREFERRED_SITE
    ) checked first and the write skipped when already in the desired state.
  • Step 4: rows + assignments classified by 
    scripts/classify-user-access.mjs
    (not eyeballed); all three core permsets always assigned to each confirmed user — 
    EmployeeSlackNotifications
    (not 
    SlackServiceUser
    ), 
    ItsmPortalUelUserPermset
    , and an API-Enabled permset (reused else created) — no "notifications-only" scope offered; 
    Agent_Access
    (never 
    Access_Agents
    ) only if the user wants the agent; assigned to confirmed user(s) only; 
    wrong-license
    surfaced, not retried.
  • Step 5b ran before any success summary: activation (
    Network.Status = 'Live'
    ), publication (pages published — not implied by Live), and a 
    NetworkMember
    per Step-4 user all confirmed (else blocking, hand remediation to 
    experience-portal-create
    ) — not skipped on 
    200/201
    .
  • Before any Step 6 guidance: the user confirmed their records (Incident / Service Request / Case) show in Slack; a "Nothing turned up" reply was fixed first. (Problem/Change staying empty is expected.)
  • If Step 6 ran: Build and Manage Agent delegated when the agent was missing; workspace connection read-checked; Connect Agentforce to Slack guided as UI-only.
  • Slack-admin-side parts (Step 1 Part 1; Step 2 Part 3; Step 6 workspace install) handed to the user.
在生成任何面向用户的摘要前，确认以下各项：
  • 已显示步骤1的内容，且用户明确确认已发送第1部分内容之后才进行任何API调用；如果未确认，则未执行任何步骤，并告知用户设置未完成。
  • 步骤2优先读取
    /connect/slackbridge/connections
    ；
    CONNECTED
    状态下跳过第2和第3部分；
    team: null
    时表述为“API暂未检测到已激活的连接”（+ 设置 → 管理Slack连接），切勿表述为“请求未提交”；仅在无法确认时才粘贴第2（批准，无伪造批准API）和第3部分内容。
  • 输出以
    (via service-itsm-slack-itservice-configure)
    标记开头；无工具名称、错误代码、端点、开发人员姓名或记录ID——名称均为易于理解的格式。
  • 每个写入操作分步执行；幂等读取（
    EmployeeServiceSlackEnabled
    、
    SLACK_PREFERRED_SITE
    ）优先检查，已处于期望状态则跳过写入。
  • 步骤4：使用
    scripts/classify-user-access.mjs
    分类用户行+权限分配（不要手动判断）；始终为每位已确认的用户分配全部三个核心权限集——
    EmployeeSlackNotifications
    （而非
    SlackServiceUser
    ）、
    ItsmPortalUelUserPermset
    ，以及一个API启用权限集（复用或创建）；不提供“仅通知”范围；仅当用户需要代理时才分配
    Agent_Access
    （切勿分配
    Access_Agents
    ）；仅为已确认的用户分配；遇到“错误许可证”时告知用户，不要重试。
  • 步骤5b在任何成功摘要前执行：已确认激活（
    Network.Status = 'Live'
    ）、已发布（页面已发布——并非由Live状态推断），且步骤4中的每个用户均为
    NetworkMember
    （否则阻塞，委托给
    experience-portal-create
    修复）——不要因返回
    200/201
    而跳过。
  • 步骤6引导前：用户已确认其记录（事件/服务请求/案例）在Slack中可见；如果回复“无结果”则先修复。（问题/变更列表为空属于正常情况。）
  • 如果执行步骤6：代理缺失时委托给“构建并管理代理”流程；读取检查工作区连接；“将Agentforce连接至Slack”作为仅UI操作引导。
  • Slack管理员端操作（步骤1第1部分；步骤2第3部分；步骤6工作区安装）已交由用户处理。

Reference File Index

参考文件索引

Each step's 
→
pointer names its reference:
  • references/manage-slack-connection.md
    (Step 2) · 
    references/manage-user-access.md
    + 
    references/record-visibility.md
    (Step 4) · 
    references/site-membership-verification.md
    (Step 5b) · 
    references/connect-agentforce-to-slack.md
    (Step 6).
  • scripts/classify-user-access.mjs
    — 
    flag-users
    tags User rows; 
    classify-assignment
    classifies a 
    PermissionSetAssignment
    POST as 
    success
    /
    wrong-license
    /
    other-error
    .
每个步骤的
→
指向对应的参考文件：
  • references/manage-slack-connection.md
    （步骤2）· 
    references/manage-user-access.md
    + 
    references/record-visibility.md
    （步骤4）· 
    references/site-membership-verification.md
    （步骤5b）· 
    references/connect-agentforce-to-slack.md
    （步骤6）。
  • scripts/classify-user-access.mjs
    ——
    flag-users
    标记用户行；
    classify-assignment
    将
    PermissionSetAssignment
    POST请求分类为
    success
    /
    wrong-license
    /
    other-error
    。

Related Skills

相关技能

SkillWhen to use instead / alongside
service-itsm-agentic-setup-employee-agent-configure
Builds/activates the IT Service Employee Agent connected in Step 6; delegated to.
service-itsm-agentic-setup-fulfiller-agent-configure
Builds/activates the Fulfiller Agent — alternative Step 6 agent.
experience-portal-create
Creates the employee Digital Experience portal this skill selects.
service-itsm-channels-coordinate
Top-level menu across ITSM channels — Slack, Swarming, Notifications, Portal.
技能替代/搭配使用场景
service-itsm-agentic-setup-employee-agent-configure
构建/激活步骤6中连接的IT服务员工代理；委托处理。
service-itsm-agentic-setup-fulfiller-agent-configure
构建/激活处理者代理——步骤6的备选代理。
experience-portal-create
创建本技能选择的员工Digital Experience门户。
service-itsm-channels-coordinate
ITSM渠道的顶级菜单——Slack、协作群、通知、门户。
",