The permission levels configured in the web UI Options page are currently not being applied to slash commands. This means that users may be able to execute slash commands even if they lack the required permission level set in the web UI.
Decision
Given the upcoming authorization refactor (planned for a future release) to a permission-based system, addressing this inconsistency is being deferred. The current implementation will be superseded by the new system, making a fix now inefficient.
Impact
While permissions are not enforced in slash commands, security is not significantly impacted because web UI is being checked if it wants access or not.
Future
This will be fully addressed as part of the broader authorization overhaul.