Summary

Support one explicitly configured Slack Enterprise Grid org-wide bot installation across every workspace where Slack has granted the app access.

Problem to solve

OpenClaw currently treats a Slack bot token as belonging to one fixed workspace. Enterprise Grid org installs instead deliver events for multiple granted workspaces through one installation. Comparing each event against the startup team_id, or reconstructing an unscoped client later, rejects valid events and can select the wrong workspace for API calls.

Proposed solution

Add an opt-in enterpriseOrgInstall Slack account mode that:

• validates the org installation's app and enterprise identity at startup;
• derives each event's workspace from Bolt's listener authorization context;
• keeps immediate replies on the listener-owned, workspace-scoped client;
• qualifies sessions, routing state, transcripts, dedupe keys, and Slack caches by workspace;
• preserves existing channel, user, mention, and bot policy after installation admission; and
• fails closed for deferred, proactive, queued, recovered, action-tool, binding, and Slack-native approval paths until workspace authorization can be persisted safely.

Existing single-workspace installations should retain their current behavior.

Alternatives considered

• One OpenClaw account and bot token per workspace: operationally expensive for Enterprise Grid organizations.
• A static OpenClaw workspace allowlist: duplicates Slack's admin-managed grant state and can drift.
• Reconstructing clients from one org token outside the listener: loses the event's authoritative installation context and risks cross-workspace API calls.

Impact

• Affected: Enterprise Grid operators using org-installed Slack apps.
• Severity: Blocking; valid messages from granted workspaces can be rejected or cannot be replied to safely.
• Frequency: Every event from a workspace that differs from the startup identity.
• Consequence: Organizations cannot use a single org-installed app across granted workspaces without separate gateway accounts.

Evidence/examples

Slack Bolt already gives each listener the event-specific authorization context and a scoped WebClient. The implementation can validate that context, keep it in the synchronous listener stack, and test two workspaces under one enterprise plus wrong-app, wrong-enterprise, and missing-workspace rejection cases.

Additional information

This initial scope intentionally supports direct message and app_mention events and immediate replies only. Broader detached delivery should remain unsupported until workspace scope can be represented durably.