An admin scopes permissions on a per-channel basis. It doesn't allow external actions until an owner specifically provisions that tool for that channel. I think.

But people can be invited to a channel after @Claude is provisioned. So yeah, I suppose you'll need to be deliberate about channel memberships.

Which is a bad pattern. Around here, you can be granted access to most channels just with vague reasons for why you need to be in there. This is a disaster. Culture will degrade. Suspicions will grow. Security theater.