I built something similar at my org. Users simply connect the agent via OAuth and that inherits all of their permissions, so it acts as them.

What's cooler is then it can view/add/remove people from channels, so it can conduct access reviews -- overall I consider it a security improvement.