Control AI agent tool access with Port RBAC and Slack mentions
Needs changesNeeds changes. This template uses 2 thing(s) that n8n 3.0 removes: LangChain Code (legacy), AI Agent v1 (old agent modes). 2 breaking item(s) found. Static check, last run 2026-10-19.
What to replace before upgrading
| Removed in 3.0 | Replace with |
|---|---|
| LangChain Code (legacy) Check permissions | No direct replacement |
| AI Agent v1 (old agent modes) AI Agent (v1.8) | Latest AI Agent node (Tools Agent). For SQL Agent, use a Postgres or MySQL tool with a recent AI Agent. |
Worth a look
- Slack Trigger requires a signing secret on the Slack API credential (Slack Trigger)
Rarely used nodes in this template: n8n-nodes-base.pagerDutyTool, n8n-nodes-base.awsS3Tool
Nodes used (13)
- OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - LangChain Code
@n8n/n8n-nodes-langchain.code - Edit Fields (Set)
n8n-nodes-base.set - Calculator
@n8n/n8n-nodes-langchain.toolCalculator - If
n8n-nodes-base.if - Slack Trigger
n8n-nodes-base.slackTrigger - Slack
n8n-nodes-base.slack - HTTP Request
n8n-nodes-base.httpRequest - Wikipedia
@n8n/n8n-nodes-langchain.toolWikipedia - Pager Duty Tool
n8n-nodes-base.pagerDutyTool - Aws S3Tool
n8n-nodes-base.awsS3Tool - Simple Memory
@n8n/n8n-nodes-langchain.memoryBufferWindow - AI Agent
@n8n/n8n-nodes-langchain.agent
What it does
RBAC for AI agents with n8n and Port This workflow implements role-based access control for AI agent tools using Port as the single source of truth for permissions. Different users get access to different tools based on their roles, without needing a separate permission database. For example, developers might have access to PagerDuty and AWS S3, while support staff only gets Wikipedia and a calculator. The workflow checks each user's permissions in Port before letting the agent use any tools. For the full guide with blueprint setup and detailed configuration, see RBAC for AI Agents with n8n and Port in the Port documentation. How it works The n8n workflow orchestrates the following steps: - Slack trigger — Listens for @mentions and extracts the user ID from the message. - Get user profile — Fetches the user's Slack profile to get their email address. - Port authentication — Requests an access token from the Port API using client credentials. - Permission lookup — Queries Port for the user entity (by email) and reads their allowedtools array. - Unknown user check — If the user doesn't exist in Port, sends an error message and stops. - Permission filtering — The "Check permissions" node compares each connected tool against allowedtools and replaces unauthorized ones with a stub that returns "You are not authorized to use this tool." - AI agent — Runs with only permitted tools, using GPT-4 and chat memory. - Response — Posts the agent output back to the Slack channel. Setup - Connect your Slack account and set the channel ID in the trigger node - Add your OpenAI API key - Register for free on Port.io - Create the rbacUser blueprint in Port (see full guide for blueprint setup) - Add user entities using email as the identifier - Replace YOURPORTCLIENTID and YOURPORTCLIENTSECRET in the "Get Port access token" node - Connect credentials for any tools you want to use (PagerDuty, AWS, etc.) - Update the channel ID in the Slack nodes - Invite the bot to your Slack channel - You should be good to go! Prerequisites - You have a Port account and have completed the onboarding process. - You have a working n8n instance (self-hosted) with LangChain nodes available. - Slack workspace with bot permissions to receive mentions and post messages. - OpenAI API key for the LangChain agent. - Port client ID and secret for API authentication. - (Optional) PagerDuty, AWS, or other service credentials for tools you want to control. ⚠️ This template is intended for Self-Hosted instances only.